CVE-2026-95387

Executive Summary

CVE-2026-95387 is a heap-based buffer overflow (CWE-122) in the SPDY protocol dissector affecting Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a denial-of-service (application crash) or potentially achieve code execution on a system running a vulnerable Wireshark instance by supplying a malformed SPDY packet capture or by streaming crafted SPDY traffic to an interface monitored by Wireshark. With a CVSS v3.1 base score of 8.1, this vulnerability is rated High severity; the attack is network-reachable but requires a high degree of complexity, and successful exploitation yields full loss of confidentiality, integrity, and availability on the targeted host.

Technical Analysis

Wireshark is a widely deployed network protocol analyzer used for packet capture, deep packet inspection, and protocol troubleshooting. Its architecture relies on a modular dissector framework: each protocol (e.g., SPDY, HTTP/2, TCP) is implemented as a dissector plugin that parses raw packet bytes into structured protocol trees. The SPDY dissector is responsible for decoding the deprecated SPDY protocol (the precursor to HTTP/2) as specified in Google's early drafts and its later standardization line.

CVE-2026-95387 is classified under CWE-122 (Heap-based Buffer Overflow). This weakness class occurs when a buffer is allocated on the heap with a fixed size but a write operation exceeds that allocated boundary, corrupting adjacent heap metadata or data. In the context of a protocol dissector, this typically arises when a length field embedded in the packet is trusted and used either to allocate a buffer or to copy data into it without proper bounds validation. An attacker who controls the bytes in a crafted packet can therefore manipulate that length field so that data is written beyond the intended region of the heap.

The affected versions are the 4.6.x branch (4.6.0 through 4.6.8) and the 4.4.x branch (4.4.0 through 4.4.18). The vulnerability is network-facing: any interface monitored by Wireshark — a physical NIC in promiscuous mode, a capture file (.pcap/.pcapng), or a remote capture stream — can deliver the malicious SPDY frame. Because Wireshark parses packets in the user context running the capture process, memory corruption occurs in the Wireshark process itself. The NVD description explicitly states the outcome is a "denial of service" (crash), but because the root cause is a heap overflow rather than a simple null dereference, the potential for control-flow hijacking or arbitrary code execution cannot be excluded from the vulnerability class alone. No public proof-of-concept or exploit code exists as of this writing, and the patch status is UNPATCHED across all tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An adversary identifies a host running a vulnerable Wireshark build (4.6.0–4.6.8 or 4.4.0–4.4.18). Targets are commonly security analysts, incident responders, or network engineers who run Wireshark interactively or via automated capture tooling. The attacker need not have any prior authentication to the Wireshark host; the attack surface is the network segment being monitored.

2. Triggering the flaw. The attacker crafts a SPDY packet containing a malformed length or framing field that causes the dissector to compute a size inconsistent with the actual SPDY payload. Because the attacker controls the packet bytes, the length value can be set to overstate or understate the on-wire data, violating the invariant the dissector relies on. When Wireshark processes the packet, the SPDY dissector performs a heap write that exceeds the allocated buffer — the CWE-122 overflow.

3. Payload / execution method (vulnerability-class level). Delivery can occur through any path that feeds bytes into the dissector: injected SPDY frames on a monitored network, a malicious .pcap file opened by the victim, or a remote capture feed. The payload is the crafted SPDY frame itself; no separate exploit binary is required to trigger the memory corruption. If the overflow is sufficient to overwrite a function pointer or return address adjacent in the heap, control-flow redirection becomes possible; otherwise, the immediate effect is a heap-corruption crash of the Wireshark process.

4. Post-exploitation impact. At minimum, the Wireshark process terminates, causing loss of an in-progress capture and potentially losing forensic evidence. If code execution is achieved (plausible given CWE-122), the attacker gains the privileges of the Wireshark user — which on many analyst workstations is an interactive user with access to captured credentials, network maps, and internal traffic. CVSS rates C:H/I:H/A:H, reflecting worst-case total compromise of the analyzed host.

Impact Assessment

The CVSS v3.1 base score is 8.1 (High). Subscore interpretation:

• AV:N (Network) — the attack is reachable over a network interface; no local access to the victim is required beyond being able to send SPDY traffic into a monitored segment or deliver a capture file.
• AC:H (High) — successful exploitation requires conditions outside the attacker's direct control (precise heap layout or timing to achieve reliable corruption), which is consistent with the "requires high complexity" language typical of dissector heap overflows.
• PR:N (None) — no authentication is required.
• UI:N (None) — according to the vector, no user interaction is required; however, in practice a capture must be active (or a file opened) for the dissector to run.
• S:U (Unchanged) — impact is confined to the vulnerable Wireshark component.
• C:H / I:H / A:H — worst-case complete loss of confidentiality, integrity, and availability of the affected host.

Business impact. Wireshark is deployed across SOCs, network operations centers, incident response teams, and engineering workstations. A crash-induced loss of an active capture can blind an organization during an ongoing investigation. If code execution is realized, an analyst workstation — often privileged, with network access and cached credentials — becomes a beachhead. The blast radius spans any endpoint running the affected versions that processes SPDY traffic or opens untrusted capture files. SPDY is largely deprecated in favor of HTTP/2, but legacy internal services, older mobile infrastructure, and archived capture corpora may still contain SPDY traffic, sustaining the attack surface.

Detection Guidance

Sigma Rule

title: Wireshark SPDY Dissector Heap Overflow Attempt (CVE-2026-95387)
id: 9f3c1a72-5b8e-4d21-a6f0-2e7c9d4b8a11
status: experimental
description: Detects crashes of Wireshark processes processing SPDY traffic, indicative of CVE-2026-95387 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95387
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
  selection_crash:
    - ExitCode: '3221225477'
    - ExitCode: '3221226356'
  condition: selection_img and selection_crash
level: high
falsepositives:
  - Legitimate malformed captures causing parser crashes
  - Application instability unrelated to SPDY

YARA Rule

rule CVE_2026_95387_SPDY_Dissector_Heap_Overflow
{
    meta:
        author = "valtersit.com"
        description = "Detects malicious SPDY frames with anomalous length fields targeting Wireshark SPDY dissector"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95387"
        date = "2026-01-01"
        severity = "high"
        cve = "CVE-2026-95387"

    strings:
        $spdy_magic = { 80 03 00 }        // SPDY/3 control frame marker
        $spdy_magic2 = { 80 02 00 }       // SPDY/2 control frame marker
        $api_marker = { 80 02 00 }        // legacy marker for correlation

    condition:
        ($spdy_magic or $spdy_magic2) and filesize < 5MB
}

Note: The rule flags capture files and streams carrying SPDY control frames; pair with a length-field consistency check in a downstream tool to reduce false positives, since a pure byte-pattern rule cannot itself validate the overflow condition.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-95387 Wireshark SPDY dissector malformed frame (heap overflow attempt)"; flow:to_server,established; content:"|80 03 00|"; depth:3; byte_test:1,>,0,offset:2; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-95387; sid:10095387; rev:1;)

Elastic Detection

process where event.type == "end" and
  process.name in ("wireshark", "tshark", "dumpcap") and
  process.exit_code in ("3221225477", "3221226356", "139", "134")

Exit code 139 (SIGSEGV) / 134 (SIGABRT) on Linux and 0xC0000005 on Windows indicate the memory-corruption crash expected from CWE-122 exploitation.

Splunk SPL Query

index=endpoint sourcetype=process:events (process_name="wireshark*" OR process_name="tshark*" OR process_name="dumpcap*")
| where exit_code IN (3221225477, 3221226356, 139, 134)
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(user) as users
    by process_name, exit_code
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-95387,">
  <rule id="100953" level="12">
    <if_sid>59200</if_sid>
    <field name="win.eventdata.image">wireshark\.exe$|tshark\.exe$|dumpcap\.exe$</field>
    <field name="win.system.eventID">^1000$</field>
    <description>CVE-2026-95387: Wireshark/tshark/dumpcap crashed - possible SPDY dissector heap overflow exploitation</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory has been confirmed by any tracked source.

1. Immediate mitigations.

   • Avoid opening untrusted or unexpected packet captures (.pcap/.pcapng) on production or analyst workstations until a fixed release is available.
   • Restrict live capture to trusted, segmented network interfaces; where possible, run Wireshark/tshark in an isolated VM, container, or sandbox with no access to sensitive credentials or production networks.
   • Drop or filter SPDY traffic at network egress/ingress where the protocol is not required, reducing the volume of untrusted SPDY bytes that reach the dissector.
   • Run capture tooling with least privilege (dedicated capture user, no access to privileged credential stores).

2. Patch / upgrade steps.

   • Monitor the vendor advisory and NVD entry for CVE-2026-95387 for a fixed release covering the 4.6.x and 4.4.x branches.
   • Because no patch currently exists, treat affected versions (4.6.0–4.6.8, 4.4.0–4.4.18) as unpatched. When a fix is published, upgrade all instances and re-validate captures.
   • Track the vendor's release notes and security advisories for a version outside the affected ranges.

3. Long-term hardening.

   • Adopt a capture-sandbox policy: all third-party captures are opened in a hardened, network-isolated VM.
   • Enable automated crash telemetry (exit-code monitoring in EDR/SIEM) to detect exploitation attempts early.
   • Maintain an inventory of Wireshark/tshark deployments and enforce prompt patching once a fix is released.
   • Prefer parsing piped capture data through sanitized, up-to-date builds and keep dissector plugins updated.

References

• NVD — CVE-2026-95387: https://nvd.nist.gov/vuln/detail/CVE-2026-95387
• MITRE CWE-122 — Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Wireshark Security Advisories (vendor): https://www.wireshark.org/security/
• CISA KEV catalog (no CVE-2026-95387 entry as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-95387; PoC status is None and no Nuclei template exists.