CVE-2026-95392

Executive Summary

CVE-2026-95392 is a denial-of-service vulnerability in the MBIM protocol dissector affecting Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a buffer condition classified as CWE-126 (Buffer Over-read) by supplying a malformed MBIM capture, causing the dissector to read past the end of an allocated buffer and crash the application. Because exploitation requires the victim to open a crafted packet trace (user interaction) in a local context, the primary impact is loss of availability of the Wireshark process on engineering and analysis workstations.

Technical Analysis

The vulnerability resides in the Wireshark MBIM (Mobile Broadband Interface Model) protocol dissector. MBIM is the USB/PCIe control protocol used by cellular modems to expose networking and device-management functions to a host operating system. Wireshark implements a dedicated dissector to decode MBIM command and notification payloads from captured traffic.

The assigned CWE is CWE-126 (Buffer Over-read). This indicates that the dissector does not correctly validate a length or offset field derived from the packet against the actual number of bytes present in the captured buffer. When a truncated or internally inconsistent MBIM frame is parsed, the dissector advances a read pointer beyond the end of the allocated buffer and dereferences it. The result is an out-of-bounds read that terminates the process — the definition of a dissector crash in Wireshark's architecture.

Two attack-surface properties are relevant. First, dissector code runs on the analyst workstation processing untrusted input; a pcap/pcapng file may originate from any third party (shared bug report, capture archive, incident hand-off). Second, Wireshark's build hardening may convert the over-read into an abort/segfault rather than silent disclosure, which is consistent with the "denial of service" classification. No public proof-of-concept, Nuclei template, or exploit code is available, and no function names, class names, or file paths are disclosed in the reference data — the analysis therefore remains at the vulnerability-class level.

The CVSS vector AV:L/AC:L/PR:N/UI:R reflects that exploitation is local to the victim machine and requires the victim to open the malicious capture; C:N/I:N/A:H confirms confidentiality and integrity are unaffected, while availability impact is high because an unhandled crash terminates the process and can lose unsaved capture state. The base score is 5.5 (Medium).

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the CWE-126 class and the dissector crash classification.

1. Reconnaissance / target identification. An adversary identifies a target that uses Wireshark for cellular/mobile-network analysis, packet forensics, or QA of modem firmware — e.g., by observing shared capture files in public bug trackers, mailing lists, or code-review comments, or by knowing that a partner team routinely exchanges MBIM traces.

2. Triggering the flaw class. The attacker crafts or mutates an MBIM capture such that a length or offset field inside an MBIM control message does not match the number of bytes actually present in the file. In a CWE-126 condition, the dissector trusts the embedded length and advances its read cursor past the end of the buffer.

3. Delivery and execution. The malformed capture is delivered as a file (e.g., attached to a support ticket, pasted in a chat channel, committed to a shared repository) and opened by the analyst in the affected Wireshark version. Because the flaw is in the dissector, no user action beyond opening/parsing the file is required for the over-read to occur. Distribution as a live capture over a monitoring interface is also theoretically possible if the malformed MBIM traffic is generated on the monitored USB/PCIe path, but the file-based vector dominates.

4. Post-exploitation impact. Wireshark crashes (abort/segfault), terminating the analysis session. Repeated delivery of the crafted file constitutes a persistent denial of service against the analysis workflow. There is no code-execution primitive described in the reference data, and no evidence of remote exploitation, data exfiltration, or lateral movement.

Impact Assessment

The blast radius is bounded to systems running an affected Wireshark build that a user is induced to open a malicious MBIM capture on. The CVSS subscores make the risk profile explicit: A:H means a successful trigger reliably removes the availability of the application, while C:N/I:N mean no confidentiality or integrity loss is expected from the described flaw. UI:R means the attacker must persuade a user to open the file, and AV:L/PR:N mean no network reachability or credentials are needed once the file is delivered.

Business impact concentrates on engineering continuity and evidence handling. For SOC and DFIR teams, a crashed dissector during incident triage can delay analysis and, if capture state is unsaved, destroy volatile evidence. For telecom/modem QA teams that routinely exchange MBIM traces with third parties, the same vector can be used to repeatedly disrupt validation pipelines that auto-parse captures. No CISA KEV listing is present and EPSS has not scored the CVE, so opportunistic, mass exploitation is not currently expected; the risk is targeted or nuisance-grade denial of service.

Detection Guidance

Sigma Rule

title: Wireshark MBIM Dissector Crash Attempt (CVE-2026-95392)
id: 8f3c1a4e-9539-4206-9d1e-6c2b7a5f0d31
status: experimental
description: Detects crashes of Wireshark/tshark consistent with MBIM dissector over-read when parsing malicious captures.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95392
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_crash:
    EventID: 1000
    Data|contains|all:
      - 'MBIM'
  selection_fault:
    Provider_Name: 'Application Error'
    Data|contains:
      - 'wireshark.exe'
      - 'tshark.exe'
  condition: selection_proc or selection_crash or selection_fault
falsepositives:
  - Legitimate malformed captures used in dissector fuzzing/QA
level: medium

YARA Rule

rule CVE_2026_95392_MBIM_Malformed_Capture
{
    meta:
        description = "Detects capture files containing MBIM payloads with inconsistent length fields (CVE-2026-95392)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95392"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pcap_magic_be = { A1 B2 C3 D4 }
        $pcap_magic_le = { D4 C3 B2 A1 }
        $pcapng_magic  = { 0A 0D 0D 0A }
        $wireshark     = "wireshark" ascii nocase
        $mbim          = "MBIM" ascii

    condition:
        ($pcap_magic_be at 0 or $pcap_magic_le at 0 or $pcapng_magic at 0) and
        ($wireshark or $mbim)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-95392 Wireshark MBIM Dissector Crash Attempt"; flow:to_client,established; content:"|0A 0D 0D 0A|"; depth:4; content:"MBIM"; nocase; classtype:attempted-dos; sid:2026953; rev:1; reference:cve,2026-95392; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95392;)

Elastic Detection

process where event.type == "start" and
  process.name in ("wireshark.exe", "tshark.exe", "dumpcap.exe") and
  process.args != null

Splunk SPL Query

index=endpoint (source="XmlWinEventLog:Application")
| search (EventCode=1000 OR Provider_Name="Application Error")
| search ("wireshark.exe" OR "tshark.exe" OR "MBIM")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(Data) as fault_data
        by host, EventCode
| where count > 0

Wazuh OSSEC Rule

<group name="windows,wireshark,">
  <rule id="100953" level="10">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.message">\.exe</field>
    <field name="win.system.message">MBIM|wireshark|tshark</field>
    <description>CVE-2026-95392: Wireshark/tshark crash after opening MBIM capture (possible DoS attempt)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Do not open MBIM captures from untrusted or unverified sources in affected Wireshark builds (4.6.0-4.6.8, 4.4.0-4.4.18).
   • If MBIM analysis is not required, disable the MBIM dissector via Analyze → Enabled Protocols to remove the attack surface entirely for routine workflows.
   • Parse untrusted captures inside a disposable VM or sandboxed container so a crash cannot affect the analyst host or unsaved evidence.
   • Validate the provenance of exchange captures (hash + source) before ingest into automated pipelines, and process third-party captures in a quarantined pipeline stage that tolerates process termination.

2. Patch/upgrade steps.

   • No vendor fix has been published or referenced in any tracked source. Monitor the official Wireshark security advisories page for a fixed 4.6.x / 4.4.x release addressing the MBIM dissector over-read, and the corresponding release notes for the CVE identifier.
   • When a fixed version is published, upgrade Wireshark and tshark on all analysis workstations and CI/build agents, and pin the patched version in any container image or golden workstation baseline.

3. Long-term hardening.

   • Subscribe to the Wireshark security advisory feed and treat packet-analyzer versions as part of the managed vulnerability surface.
   • Add fuzzing (e.g., continuous corpus fuzzing of dissectors) to any in-house capture-processing service that auto-parses third-party files.
   • Enforce least privilege on analysis hosts and enable crash/telemetry collection so dissector crashes in the MBIM parser are logged and correlated (see Detection Guidance).

References

• NVD — CVE-2026-95392: https://nvd.nist.gov/vuln/detail/CVE-2026-95392
• MITRE CWE-126 (Buffer Over-read): https://cwe.mitre.org/data/definitions/126.html
• Wireshark Security Advisories: https://www.wireshark.org/security/
• Wireshark Release Notes (4.4.x / 4.6.x): https://www.wireshark.org/docs/relnotes/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-95392 in the provided data. No public PoC, exploit code, or Nuclei template exists; the EPSS score is not yet available from FIRST.org.