CVE-2026-95386

Executive Summary

CVE-2026-95386 is a denial-of-service vulnerability in Wireshark versions 4.6.0 through 4.6.8, caused by an infinite loop (CWE-835) in the TTL file parser. An attacker can trigger it by supplying a malformed TTL file that is opened by the victim, causing Wireshark to hang and consume CPU indefinitely (CVSS 5.5, availability-only impact). Exploitation requires local interaction (AV:L) and user action (UI:R) — the victim must open a crafted capture/input file — so it is not remotely or automatically exploitable, and no public PoC or KEV listing exists.

Technical Analysis

The vulnerability is classified as CWE-835: "Loop with Unreachable Exit Condition ('Infinite Loop')." Wireshark's dissector/parser for the TTL format does not guarantee forward progress or a terminating condition when parsing malformed input, so a crafted TTL file causes the parser to loop indefinitely rather than terminating with an error.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H maps as follows:

• AV:L (Local): the attack is delivered via a file opened in the local Wireshark process, not over a network service.
• AC:L (Low): no special conditions are needed beyond opening the file.
• PR:N (None): the attacker needs no privileges on the victim host.
• UI:R (Required): the victim must actively open the malicious TTL file.
• S:U (Unchanged): the impact stays within the Wireshark process/security scope.
• C:N / I:N: confidentiality and integrity are unaffected.
• A:H (High): availability is fully lost — the parsing thread/process hangs.

Because the failure mode is a non-terminating loop, the observable effect is a hung or unresponsive Wireshark instance with sustained CPU consumption, terminating only when the process is killed. No memory corruption, code execution, or data disclosure is implied by the description.

The NVD description is sparse and does not name the specific function, file, or code path involved. No function names, file paths, or parameter names are specified, so they are not asserted here. Affected versions are 4.6.0 to 4.6.8; the fix is confirmed by two independent sources (OSV and Debian), and an OSV package entry references an in-progress/unfixed commit marker cdfb6721e77c19d43f4787f66e9d5f2525281a22, indicating a fix was in the pipeline.

Exploitation Scenarios

No public proof-of-concept exists; the attack chain below is inferred strictly from the vulnerability class (infinite loop in the TTL parser) and the CVSS context.

1. Reconnaissance / target identification: The attacker identifies a target that uses Wireshark 4.6.0–4.6.8 to open externally-supplied capture/input files. This is common in network operations, incident response, and forensic workflows where analysts inspect files received by email, shared via chat, or downloaded from public repositories.

2. Triggering the flaw class: The attacker supplies a crafted TTL file. When any of these files is opened by a user — via File > Open or by double-clicking — the TTL parser enters an infinite loop while processing malformed input. The malicious content is a non-terminating parser path rather than executable code.

3. Delivery / execution method (vulnerability-class level): Delivery is social engineering / file-sharing based. The attacker must induce the victim to open the file (UI:R). No payload execution in the traditional sense occurs; the "payload" is simply input data that drives the parser into a non-terminating loop.

4. Post-exploitation impact: The concrete impact is denial of service. The affected Wireshark instance becomes unresponsive and must be terminated. On a workstation this is an annoyance; in an automated or shared analysis pipeline, a hung parser can stall or crash a processing job, delaying incident response or forensic analysis. There is no confidentiality or integrity impact.

Note: no public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

• Confidentiality: None (C:N).
• Integrity: None (I:N).
• Availability: High (A:H) — the affected process hangs indefinitely, requiring manual termination or restart.
• Scope: Unchanged (S:U) — impact is confined to the Wireshark process.

Business impact is operational rather than data-centric. Organizations relying on Wireshark for time-sensitive network troubleshooting, security monitoring, or digital forensics could see workflow disruption if a crafted file is opened. The blast radius is limited to the individual analyst instance/pipeline that processes the file; there is no lateral movement, no credential exposure, and no persistent compromise. The EPSS score of 0.00128 (2.1st percentile) and absence from CISA KEV indicate low observed exploitation activity in the wild.

Detection Guidance

Sigma Rule

title: Wireshark TTL Parser Denial-of-Service via Malformed File
id: 9f6d2a44-8c17-4f0b-9d3e-2a7b5c1e6f01
status: experimental
description: Detects Wireshark processes spiking CPU and failing to exit after opening a TTL file, consistent with CVE-2026-95386 infinite loop in the TTL parser.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95386
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
  selection_cmd:
    CommandLine|contains:
      - '.ttl'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate opening of valid TTL files
level: low
tags:
  - attack.t1203
  - cve.2026.95386

YARA Rule

rule CVE_2026_95386_Wireshark_TTL_DoS
{
    meta:
        description = "Heuristic detection of TTL files potentially crafted to trigger the Wireshark TTL parser infinite loop (CVE-2026-95386)"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95386"
        date = "2026-01-01"
        cve = "CVE-2026-95386"

    strings:
        // TTL/Turtle-family markers — adjust to confirmed format on triage
        $ttl1 = "@prefix" ascii wide nocase
        $ttl2 = "@base" ascii wide nocase
        $nested_open = "{" ascii
        $nested_close = "}" ascii

    condition:
        filesize < 2MB and
        (
            $ttl1 or $ttl2
        ) and
        #nested_open > 500 and
        #nested_close < (#nested_open / 2)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-95386 Wireshark TTL File Transfer (Potential DoS Trigger)"; flow:established,to_server; filestore; fileext:"ttl"; classtype:attempted-dos; reference:cve,2026-95386; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95386; sid:202695386; rev:1;)

Elastic Detection

process where process.name in ("wireshark.exe", "tshark.exe", "wireshark") and
  process.args : "*.ttl" and
  not process.parent.name in ("explorer.exe", "bash")

Note: Pair with a host-metrics rule that alerts when a Wireshark process holds sustained CPU (e.g., system.process.cpu.total.pct > 0.9) for an extended interval without exiting — the definitive runtime indicator of the CVE-2026-95386 infinite loop.

Splunk SPL Query

index=endpoint (process_name="wireshark.exe" OR process_name="tshark.exe" OR process_name="wireshark")
| search process_command_line="*.ttl*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, process_command_line
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Supplement with a CPU-anomaly correlation:

index=perfmon object="Process" counter="% Processor Time" instance IN ("wireshark","tshark")
| where Value > 90
| stats avg(Value) as avg_cpu by host, instance
| where avg_cpu > 90

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-95386,">
  <rule id="100586" level="6">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">wireshark.exe|tshark.exe</field>
    <field name="win.eventdata.commandLine">\.ttl</field>
    <description>CVE-2026-95386: Wireshark/tshark opened a TTL file - possible TTL parser denial-of-service trigger</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix: OSV and Debian).

1. Immediate mitigations

   • Upgrade Wireshark to a release after 4.6.8 (the fixed build). Until upgrade is possible, treat unknown/untrusted capture or TTL files as hostile.
   • Do not open TTL-format files from untrusted sources (email attachments, chat, public repositories) in Wireshark 4.6.0–4.6.8.
   • Where feasible, run Wireshark in a sandboxed or disposable VM so a hung parser does not disrupt primary analyst workstations.
   • Enforce file-type filtering at email/web gateways and block or quarantine unexpected .ttl attachments.

2. Patch / upgrade steps

   • Apply the vendor update for the TTL parser fix referenced by the OSV and Debian advisories; confirm the installed build is newer than 4.6.8.
   • Verify the applied version via Help > About Wireshark or tshark -v.
   • Track the OSV entry (commit cdfb6721e77c19d43f4787f66e9d5f2525281a22) for status confirmation and the corresponding Downstream fixed version.

3. Long-term hardening

   • Maintain an inventory of analysis tooling and apply security updates through a managed patch pipeline.
   • Include packet-analysis tools in periodic vulnerability scanning and SBOM tracking.
   • Adopt least-privilege and process-isolation practices for tools that parse untrusted input; add resource/timeout limits around automated parsing jobs so a single malformed input cannot stall a pipeline.
   • Monitor vendor security advisories for Wireshark to catch future parser-related DoS issues early.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95386
• OSV advisory entry (fix confirmed; commit cdfb6721e77c19d43f4787f66e9d5f2525281a22)
• Debian security tracker / advisory for Wireshark (fix confirmed)
• Wireshark security advisories page: https://www.wireshark.org/security/
• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'): https://cwe.mitre.org/data/definitions/835.html

Threat actor campaigns / exploit-in-the-wild: None identified. The CVE is not listed in CISA KEV, EPSS is 0.00128 (2.1st percentile), and no public PoC, Nuclei template, or exploit code is available.