It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3252 advisory.

    TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service (CVE-2026-95386)

    The spdy_assemble_data_frames() function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame     payload fragment lengths into a uint32_t variable named datalen without any overflow protection. When the     total accumulated fragment data exceeds 2^32 bytes (4,294,967,296), the datalen variable wraps to a small     value. This wrapped value is then passed to wmem_alloc() as the allocation size, producing a buffer     drastically smaller than the actual data. The subsequent memcpy() calls then write the full ~4.3 GB of     attacker-controlled fragment data past the end of the tiny allocation, corrupting the heap.
    (CVE-2026-95387)

    Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-95388)

    SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service     (CVE-2026-95389)

    The PEAK TRC v1 ERROR-frame parser splits the data column and passes bytes[0] or bytes[1] to     g_ascii_strtoull() without first validating the token count. A malformed 44-byte file therefore     dereferences NULL during automatic format detection/read. (CVE-2026-95390)

    ZigBee ZCL Touchlink: empty the commissioning map on a redissect. Wireshark crash by injecting a malformed     packet onto the wire or by convincing someone to read a malformed packet trace file (CVE-2026-95391)

    The MBIM protocol dissector could crash. Wireshark crash by injecting a malformed packet onto the wire or     by convincing someone to read a malformed packet trace file. (CVE-2026-95392)

    Heap buffer overflow (WRITE) in CSN.1 dissector -- CSN_RECURSIVE_ARRAY writes past destination array with     no capacity check (packet-csn1.c). (CVE-2026-95393)

    Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of     service (CVE-2026-95394)

    The SYNCHROPHASOR dissector (packet-synphasor.c) parses CFG3 configuration frames. The function     config_3_frame_fast() reads the num_ph (number of phasors) field from the packet without any upper bound     check, then allocates 17.8 MB of memory using wmem_file_scope() per frame. This memory is only freed when     the capture file is closed, so sending multiple frames causes memory exhaustion and process termination.A     single 78-byte UDP packet to port 4713 triggers a 17.8 MB allocation. 1000 frames (~200 KB on disk) cause     ~17 GB of memory consumption, resulting in OOM kill or g_malloc abort. (CVE-2026-95395)

    Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service     (CVE-2026-96415)

    It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing     someone to read a malformed packet trace file. The IEEE 802.11 protocol dissector could crash.
    (CVE-2026-96416)

    Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability (CVE-2026-96417)

    dissect_tiff() follows the TIFF Image File Directory (IFD) chain by repeatedly calling dissect_tiff_ifd()     with the 32-bit next IFD offset it reads verbatim from the input. There is no visited-offset set, no     requirement that the offset advance, and no iteration cap, so a TIFF whose IFD points its next-IFD field     back at itself makes the walker loop over the same bytes forever. A bounds exception cannot rescue it,     because the crafted offset is deliberately in bounds -- the whole PoC is 14 bytes and the IFD it points at     is the one already being parsed.The dissector is reachable in the default configuration: directly, via the     default-enabled wtap_file heuristic when a .tif is opened, and from ordinary captured traffic via the     image/tiff media_type entry (e.g. an HTTP/WSP/MIME body). (CVE-2026-96418)

    Toshiba captures are attacker-controlled text files processed after the handler recognizes the Toshiba     banner and a packet marker. While searching for the packet OFFSET line, the parser reads into a fixed     stack buffer with file_gets(), then forcibly truncates the current line at byte 16 and accepts it if the     prefix equals OFFSET 0001-0203. It then unconditionally parses the packet length from line+64.
    file_gets() only writes the bytes read plus one terminating NUL and does not clear the rest of the buffer,     so a short line such as OFFSET 0001-0203\n leaves line[64] and following bytes containing     stale/uninitialized stack contents from previous uses of the buffer. sscanf(line+64, ...) therefore reads     data that is not part of the current input line, and if no NUL exists in the remaining stack-buffer region     it may continue past the end of the stack object. A malicious capture can reach this path by providing a     valid Toshiba header, a valid [No.] record header, and a short OFFSET-prefix line. This is an out-of-     bounds/stale stack read in an untrusted file parser and can cause undefined behavior or a crash during     file open/read. (CVE-2026-96420)

    The USB HID dissector reconstructs a device's HID report descriptor from a GET DESCRIPTOR control-transfer     response and parses it in parse_report_descriptor(). When the descriptor declares a Usage Minimum / Usage     Maximum pair, the dissector expands the inclusive range into a wmem array with for (uint32_t j =     usage_min; j <= usage_max; j++). Both bounds come straight from the capture, and HID extended usage     items carry a full 4-byte usage value, so usage_max can be 0xFFFFFFFF. At that point j++ wraps 0xFFFFFFFF
    -> 0, the j <= usage_max test is unconditionally true, and the loop never terminates while appending 4     bytes per iteration to a file-scoped wmem array -- an infinite loop that also grows the heap without     bound. (CVE-2026-96421)

    A syntactically valid pcapng file containing many repeated packet-comment options can abort TShark when it     builds the full protocol tree with -V. Wireshark renders every comment before entering the frame     dissector's exception boundary. The normal one-million-tree-item safeguard consequently raises an uncaught     DissectorError, terminating the process instead of reporting a bounded per-packet dissection error.The     Frame protocol metadissector could crash. (CVE-2026-96422)

    The X11 dissector caches, per TCP conversation, one keysym array per keycode in     x11_conv_data_t.keycodemap[256]. Each array is allocated in listOfKeysyms() with the keysyms-per-keycode     width in force for the message being dissected, but the dissector records only a single scalar     state->keysyms_per_keycode, with no per-array width. The X_ChangeKeyboardMapping request writes entries     with a request-local width and leaves the scalar untouched; the X_GetKeyboardMapping reply sets the     scalar. The two therefore diverge. When a later KeyPress/KeyRelease event is dissected,     keycode2keysymString() indexes the cached arrays with the current scalar and never consults each array's     real length, so any array allocated narrower than the scalar is read out of bounds. This is reachable from     a capture with the default configuration (the X11 dissector is registered on TCP 6000-6063 and enabled by     default; no protocol preference or key is required). (CVE-2026-96423)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2026-3252)

high Nessus Plugin ID 371862

Version 1.2