CVE-2026-95388

Executive Summary

CVE-2026-95388 is a heap-based buffer overflow (CWE-122) affecting the sharkd utility shipped with Wireshark in versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Successful exploitation crashes sharkd, causing a denial-of-service condition. The vulnerability is exploitable with local access and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), yielding a base score of 5.5 — a high-availability-impact denial of service with no confidentiality or integrity effect. Organizations running affected Wireshark builds that expose sharkd (directly or embedded) should treat this as an availability risk until a fixed release is issued.

Technical Analysis

sharkd is a daemonized dissection engine that exposes Wireshark's protocol parsing capabilities to external callers over a socket/API. CVE-2026-95388 is classified as CWE-122 (Heap-based Buffer Overflow), meaning that a parsing routine operating on heap-allocated memory writes beyond the bounds of an allotted buffer.

The NVD description is deliberately sparse: it states only that a crash occurs in the sharkd utility across the stated version ranges and that the outcome is denial of service. No dissector name, protocol, message field, function, or file path is disclosed. Accordingly, the following is stated at the vulnerability-class level rather than at the code level:

• Root cause class: A heap buffer is sized based on attacker-influenced input, and a subsequent copy/parse operation writes or reads past that allocation. In dissection engines this typically arises when a length field, element count, or encoded string from parsed input is trusted without adequate bounds validation.
• Attack surface: The sharkd request/response interface, which accepts capture-related and dissection requests from a client. Any input path that reaches a dissection routine handling a variable-length field is a candidate trigger.
• Trigger preconditions: The attacker must supply a crafted input (a capture file, packet stream, or equivalent request payload) that is processed by the vulnerable parsing code. Because the vector is local and user interaction is required (UI:R), the triggering artifact must be delivered to and acted upon by a user or process that feeds sharkd.
• Impact mechanism: The out-of-bounds access corrupts heap metadata or control data, causing sharkd to abort (crash). The CVSS subscore profile (C:N/I:N/A:H) indicates the disclosed impact is availability only — no confidentiality or integrity impact is asserted by the CVSS assignment.

The vulnerability mechanism is therefore a memory-safety defect in input parsing, and the confirmed security consequence per authoritative data is a crash of the sharkd process. No information is available indicating remote code execution, and none should be assumed.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-95388. The following attack chain is inferred strictly from the vulnerability class (heap-based buffer overflow in an input parser) and the CVSS vector; no specific function names, endpoints, or field names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The adversary identifies a host running an affected Wireshark release (4.6.0–4.6.8 or 4.4.0–4.4.18) where sharkd is available or invoked as part of a capture-processing workflow. This is a local/adjacent capability scenario rather than an internet-facing service target, consistent with AV:L.
2. Triggering the flaw class. The attacker crafts an input artifact — a capture file or equivalent request payload containing malformed length/count/value data — designed to cause the parser to overrun a heap-allocated buffer. Because UI:R applies, the artifact must be opened, loaded, or submitted by a user or an automated process that passes it to sharkd.
3. Execution method at the class level. The malformed input is processed by the vulnerable dissection path. The parser writes beyond the intended heap allocation, corrupting adjacent memory. No specific payload encoding, field offset, or code path is asserted here, as the disclosure does not provide it.
4. Post-exploitation impact. The immediate and only confirmed result is a crash of the sharkd utility (denial of service). Any downstream effect — such as loss of an in-progress capture session, disruption of an automated analysis pipeline, or unavailability of a dependent monitoring workflow — follows from sharkd becoming unavailable. The CVSS profile does not support claims of data exfiltration or code execution.

Because no PoC is public, defenders should not assume weaponization is trivial, but the memory-safety class is reliably crash-inducing once a triggering input is found. Monitoring for anomalous or malicious capture files submitted to analysis tooling is warranted.

Impact Assessment

The CVSS 3.1 base score is 5.5 (Medium), derived as follows:

• AV:L (Local): Exploitation requires local access to the environment where sharkd runs; this is not a remotely reachable network service in the CVSS model.
• AC:L (Low): No specialized conditions beyond delivering the crafted input are assumed.
• PR:N (None): No authentication or privileges are required of the attacker.
• UI:R (Required): A user or process must open/submit the malicious artifact.
• S:U (Unchanged): Impact remains confined to the vulnerable component.
• C:N / I:N (None): No confidentiality or integrity impact is asserted.
• A:H (High): Total loss of availability of the affected component.

Business impact: The primary consequence is loss of availability of the sharkd dissection service. Where sharkd underpins automated network forensics, continuous capture analysis, or SOC triage pipelines, a crash can halt analysis and cause data-collection gaps. Blast radius is bounded to the sharkd process and any workflow that depends on it; it does not extend to host-wide compromise per the disclosed impact profile. Triaged severity is Medium, elevated in environments where sharkd is a shared or high-uptime analysis component.

Detection Guidance

Sigma Rule

title: Sharkd Utility Crash Indicative of Heap Buffer Overflow (CVE-2026-95388)
id: 8f2b1c4e-3a7d-49d1-9e2f-5c6b7a8d9e10
status: experimental
description: Detects abnormal termination of the sharkd process, consistent with exploitation of CVE-2026-95388 (heap-based buffer overflow leading to DoS).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95388
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/sharkd'
  selection_crash:
    ExitCode: 139
  condition: selection_img and selection_crash
fields:
  - Image
  - CommandLine
  - ExitCode
falsepositives:
  - Legitimate sharkd shutdowns or other crashes unrelated to malicious input
level: medium
tags:
  - attack.t1204
  - cve.2026.95388

YARA Rule

rule CVE_2026_95388_Sharkd_Heap_Overflow_Indicator
{
    meta:
        description = "Heuristic detection for malformed capture/request artifacts targeting sharkd dissection parser (CVE-2026-95388). High-level, class-based indicator."
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95388"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $magic_pcap = { D4 C3 B2 A1 }
        $magic_pcapng = { 0A 0D 0D 0A }
        $sharkd = "sharkd" ascii nocase
    condition:
        ($magic_pcap at 0 or $magic_pcapng at 0) and uint32(0) != 0
}

Suricata IDS Rule

alert tcp any any -> any 4446 (msg:"CVE-2026-95388 Possible sharkd Malformed Dissection Request (Heap Overflow DoS)"; flow:to_server,established; content:"|00|"; depth:1; byte_test:4,>,1048576,0,relative; classtype:attempted-dos; reference:cve,2026-95388; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95388; sid:202695388; rev:1;)

Elastic Detection

process where process.name == "sharkd" and process.exit_code == 139

Splunk SPL Query

index=main (process_name=sharkd OR Image=*sharkd*)
| where exit_code=139 OR exit_code=11 OR (message="*sharkd*" AND message="*crash*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, user, exit_code
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="wireshark,sharkd,cve-2026-95388,">
  <rule id="100953" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">sharkd</field>
    <field name="process.exit_code">139</field>
    <description>CVE-2026-95388: sharkd crashed with SIGSEGV (possible heap buffer overflow DoS)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-package mapping has been published in the available data.

1. Immediate mitigations

   • Restrict or disable sharkd where it is not operationally required; do not expose it on untrusted interfaces.
   • Do not open or submit untrusted capture files or request payloads to affected sharkd instances. Treat capture artifacts from external or unverified sources as hostile.
   • Enforce least privilege and process isolation (containers, systemd sandboxing, mandatory access control) around sharkd so a crash is contained and restartable.
   • Increase monitoring for sharkd abnormal termination (SIGSEGV / exit code 139) and correlate with inbound file submissions.

2. Patch / upgrade steps

   • No fixed release has been identified in the provided sources. Monitor the vendor's security advisories and release notes for versions succeeding 4.6.8 (4.6.x line) and 4.4.18 (4.4.x line).
   • Once a fixed build is published, prioritize upgrade of any host running affected Wireshark builds, especially those with active sharkd usage. Test in a staging environment before fleet rollout.

3. Long-term hardening

   • Standardize on a supported Wireshark release stream and subscribe to vendor security notifications for timely patching.
   • Adopt memory-hardened build/deployment practices and process supervision (auto-restart with alerting) for analysis daemons.
   • Integrate capture-file/artifact scanning and sanitization into ingestion pipelines to reduce exposure to parser-targeting inputs.
   • Maintain an asset inventory of tooling that embeds or invokes sharkd so impact can be scoped quickly.

References

• NVD — CVE-2026-95388: https://nvd.nist.gov/vuln/detail/CVE-2026-95388
• Wireshark Security Advisories: https://www.wireshark.org/security/
• MITRE CWE-122 (Heap-based Buffer Overflow): https://cwe.mitre.org/data/definitions/122.html
• CISA Known Exploited Vulnerabilities Catalog (status check — not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/

Note: No public proof-of-concept, exploit code, or exploit-in-the-wild evidence is known for CVE-2026-95388 at the time of writing. CISA KEV status: NO.