CVE-2026-95389

Executive Summary

CVE-2026-95389 is a heap-based buffer overflow (CWE-122) vulnerability in the SCTP protocol dissector of the Wireshark network analysis tool, affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. It allows an attacker to trigger a dissector crash, causing a denial-of-service condition, and based on the CVSS vector the vulnerability may also permit memory corruption with confidentiality and integrity impact. Successful exploitation requires the victim to capture, open, or process a maliciously crafted SCTP packet or capture file, making this a high-severity but relatively complex attack.

Technical Analysis

The vulnerability resides in the SCTP (Stream Control Transmission Protocol) dissector component of Wireshark. CWE-122 identifies the root cause as a heap-based buffer overflow, meaning a memory buffer allocated in the heap region is written past its intended boundary. This class of flaw typically arises when a length or count field embedded in the protocol data is trusted and used to compute an allocation size, but a subsequent copy or loop operation writes more data than the buffer can hold.

In the context of a protocol dissector, the attack surface is the packet parsing logic. The SCTP dissector parses untrusted network input — SCTP chunk headers, parameter fields, and associated payloads — and translates them into displayable protocol tree entries. Because SCTP is a transport-layer protocol carried directly over IP (IP protocol number 132), malformed SCTP frames can be crafted to exercise specific dissector code paths. The CVSS vector indicates network attack vector (AV:N), no privileges required (PR:N), no user interaction (UI:N), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), with high attack complexity (AC:H) reflecting preconditions such as the victim actually processing the crafted traffic. Availability impact is explicit in the description (dissector crash / denial of service), while the C:H/I:H components suggest that an out-of-bounds heap write could theoretically be leveraged beyond a simple crash, though no memory-corruption or code-execution technique is described in the available data.

The affected version branches (4.6.x and 4.4.x) indicate the flaw was introduced within these maintenance lines. No specific function, file, chunk type, or field name is provided in the CVE description, so the precise parsing routine and trigger condition cannot be confirmed from the supplied intelligence. The vulnerability class and the dissector-crash outcome are the only implementation details that can be asserted with confidence.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (heap-based buffer overflow in a protocol dissector) and the affected product behavior. No function names, endpoints, or parameter names are invented.

1. Reconnaissance and target identification: An adversary identifies systems or analysts that process SCTP traffic with an affected Wireshark version. Targets include security operations teams capturing network traffic, forensic analysts opening packet captures, and automated analysis pipelines that ingest pcap files. Shodan-style discovery could look for exposed Wireshark-related tooling or remote capture interfaces, though the primary exposure is via malicious input files or live traffic rather than a network service.

2. Triggering the flaw: The attacker crafts or obtains a malformed SCTP packet or capture file. Because the flaw is a heap buffer overflow, the malicious input likely contains a length or count field that causes the dissector to allocate a buffer smaller than the data subsequently written into it. The crafted data is delivered either as live traffic on a monitored segment or, more commonly, as a pcap/pcapng file supplied to the victim.

3. Execution method: The victim opens the malicious capture in Wireshark or processes it through tshark or another libwireshark-based tool. During dissection, the SCTP dissector parses the malformed field and performs the out-of-bounds write, resulting in a crash. No payload-delivery mechanism beyond the crafted capture/traffic is described in the available data.

4. Post-exploitation impact: The immediate confirmed impact is a dissector crash causing denial of service — loss of the capture session and potential loss of unprocessed evidence. Based on the CVSS confidentiality and integrity subscores, a successful heap corruption could potentially enable further memory manipulation, but no such technique is documented and the practical outcome observed in the field remains a crash.

Impact Assessment

The CVSS v3.1 base score is 8.1 (High), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The network attack vector and lack of required privileges or user interaction raise the severity, while high attack complexity reflects the difficulty of reliably crafting triggering input against a specific parser. Scope is unchanged (S:U), meaning the vulnerable Wireshark process is the boundary of impact.

Business impact centers on denial of service for network operations, incident response, and forensic workflows that depend on Wireshark. A crash during live capture can interrupt monitoring; a crash while opening evidence can corrupt or stall investigations. Because the confidentiality and integrity subscores are High in the supplied vector, organizations should treat the flaw as potentially more than a simple crash, even though only the crash behavior is explicitly described. The blast radius is limited to systems running affected Wireshark/tshark versions that process attacker-influenced SCTP data or capture files. There is no evidence of wormable behavior, no CISA KEV listing, and no confirmed in-the-wild exploitation. No EPSS score has been assigned by FIRST.org at the time of writing.

Detection Guidance

Sigma Rule

title: Wireshark SCTP Dissector Crash Attempt - Suspicious Process Termination
id: 3f8c2a91-7d4e-4b1a-9c6f-2e5a8b0d1f77
status: experimental
description: Detects abnormal termination of Wireshark or tshark processes consistent with a dissector crash triggered by malformed SCTP input (CVE-2026-95389).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95389
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.effect
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_crash:
    ExitCode: '3221225477'
  condition: selection_image and selection_crash
falsepositives:
  - Legitimate Wireshark crashes from unrelated bugs or out-of-memory conditions
  - Debugging sessions intentionally terminating the process
level: medium

YARA Rule

rule CVE_2026_95389_SCTP_Malformed_Capture
{
    meta:
        description = "Detects SCTP capture files or payloads with anomalous length fields possibly linked to CVE-2026-95389 heap overflow"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95389"
        severity = "high"

    strings:
        $pcap_magic_le = { D4 C3 B2 A1 }
        $pcap_magic_be = { A1 B2 C3 D4 }
        $pcapng_magic  = { 0A 0D 0D 0A }
        $sctp_hint     = "SCTP" ascii nocase

    condition:
        ($pcap_magic_le at 0 or $pcap_magic_be at 0 or $pcapng_magic at 0) and
        $sctp_hint and
        filesize < 50MB
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-95389 Possible Wireshark SCTP Dissector Heap Overflow Attempt"; \
  ip_proto:132; \
  flow:stateless; \
  dsize:>0; \
  threshold: type limit, track by_src, count 5, seconds 60; \
  classtype:attempted-dos; \
  reference:cve,CVE-2026-95389; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95389; \
  sid:90095389; rev:1;)

Elastic Detection

process where event.type == "end" and
  process.name in ("wireshark.exe", "tshark.exe", "dumpcap.exe") and
  process.exit_code != 0 and
  process.exit_code != null

Splunk SPL Query

index=endpoint sourcetype=WinEventLog:Security OR sourcetype=sysmon
(process_name IN ("wireshark.exe","tshark.exe","dumpcap.exe"))
| where exit_status != 0
| stats count min(_time) as first_seen max(_time) as last_seen
        by host, user, process_name, exit_status, parent_process_name
| where count >= 1
| sort - first_seen

Wazuh OSSEC Rule

<group name="windows,sysmon,wireshark,">
  <rule id="100953" level="10">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.image">wireshark.exe|tshark.exe|dumpcap.exe</field>
    <field name="win.eventdata.exitStatus">3221225477|3221225725</field>
    <description>CVE-2026-95389: Wireshark/tshark dissector crash detected - possible malformed SCTP input</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack, dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Avoid processing SCTP traffic or opening untrusted SCTP capture files with affected Wireshark/tshark versions until a fix is available.
• Where SCTP analysis is required, perform it in an isolated, non-production environment or disposable virtual machine to contain a crash.
• Apply application allow-listing and endpoint monitoring to detect abnormal termination of wireshark.exe, tshark.exe, and dumpcap.exe.
• Restrict the distribution of capture files from untrusted sources and scan captures with static YARA rules before opening them.

2. Patch/upgrade steps:

• No patched release is identified in the supplied data. Monitor the Wireshark security advisories page and the official download site for updated 4.6.x and 4.4.x releases that address CVE-2026-95389.
• When a fixed version is confirmed, upgrade affected installations on both the 4.6 and 4.4 branches and verify the installed version.
• Subscribe to Wireshark security announcements to receive patch notifications promptly.

3. Long-term hardening:

• Maintain a vulnerability management process that tracks CVEs for network analysis tooling used by SOC, IR, and forensic teams.
• Isolate capture-analysis workstations from production networks and treat capture files as untrusted input.
• Consider running dissectors with reduced privileges and leverage crash reporting to correlate with known dissector vulnerabilities.
• Periodically review and update Wireshark and libwireshark dependencies across all analysis endpoints and pipelines.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95389
• Wireshark Security Advisories: https://www.wireshark.org/security/
• CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-95389 not listed at time of writing)

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the supplied data.