CVE-2026-95393

Executive Summary

CVE-2026-95393 is a denial-of-service vulnerability in the CSN.1 protocol dissector affecting Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can crash the dissector by supplying a malformed CSN.1-encoded packet or capture file that triggers a heap-based buffer overflow (CWE-122). The impact is limited to availability (CVSS 4.7), requiring local access and user interaction for successful exploitation.

Technical Analysis

The vulnerability resides in the CSN.1 protocol dissector, which is responsible for parsing CSN.1 (Concrete Syntax Notation One) encoded data. CSN.1 is a formal notation used to describe the syntax of encoded messages, commonly found in telecommunications protocols such as GSM, UMTS, and other 3GPP standards. Wireshark's dissector decodes these messages for analysis.

CWE-122 indicates a heap-based buffer overflow. This class of vulnerability occurs when the dissector allocates a buffer on the heap and writes more data into it than it can hold, typically due to insufficient bounds checking on input-controlled length fields or loop counters. In the context of a protocol dissector, this can be triggered by a crafted packet where a length field or repetition count causes the dissector to read or write beyond the allocated memory region. The exact function or code path is not specified in the available NVD description; however, the vulnerability class strongly suggests an out-of-bounds write or read within the dissector's parsing logic when processing malformed CSN.1 data.

The attack surface is the packet parsing engine. An attacker must deliver a maliciously crafted packet or capture file to the victim. This could be achieved by sending the packet over the network if the victim is actively capturing traffic on an interface that receives such packets, or by convincing the victim to open a malicious pcap file. The CVSS vector indicates local attack vector (AV:L), high attack complexity (AC:H), no privileges required (PR:N), and user interaction required (UI:R). This aligns with a scenario where the attacker must either be on the same local network segment to inject packets or must trick the user into opening a crafted capture file.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain is inferred from the vulnerability class and CVSS metrics.

1. Reconnaissance/target identification: The attacker identifies a target running an affected version of Wireshark. This could be an analyst workstation, a network monitoring server, or an embedded system using Wireshark's dissection engine. The attacker may also target users who routinely open untrusted capture files.

2. Triggering the flaw: The attacker crafts a packet or capture file containing malformed CSN.1-encoded data. The specific malformation likely involves a length field or structural element that causes the dissector to miscalculate buffer boundaries when parsing the CSN.1 stream. The attacker then either injects this packet onto a network segment being monitored by the victim (e.g., via ARP spoofing, raw socket injection, or a compromised host on the same LAN) or delivers the crafted pcap file through social engineering (e.g., email attachment, file-sharing link).

3. Payload/execution method: The payload is the malformed CSN.1 data itself. When Wireshark processes the packet or file, the dissector attempts to parse the CSN.1 structure. Due to the missing bounds check (CWE-122), the parsing routine writes beyond the allocated heap buffer, leading to memory corruption. This typically results in an immediate crash of the Wireshark process (denial of service). The CVSS vector assigns high attack complexity (AC:H), suggesting that triggering the overflow reliably may require precise manipulation of the input, and the lack of a public exploit indicates that weaponization is non-trivial.

4. Post-exploitation impact: The primary impact is a crash of the Wireshark application, causing loss of any unsaved capture data and disruption of monitoring or analysis activities. Because the vulnerability is a heap overflow, there is a theoretical possibility of code execution; however, the CVSS vector assigns no impact to confidentiality or integrity (C:N/I:N) and only high impact to availability (A:H), which is consistent with a pure denial-of-service outcome in the context of this scoring. Remote code execution is not indicated by the provided data. No lateral movement or data exfiltration is expected from this specific flaw.

Impact Assessment

The CVSS v3.1 base score is 4.7 (Medium), with the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H. This reflects:

• Availability (A:H): Successful exploitation crashes the Wireshark process, causing a denial of service. For organizations relying on continuous network monitoring, this can blind security operations and delay incident response.
• Confidentiality and Integrity (C:N/I:N): No direct impact on data confidentiality or integrity is indicated.
• Attack Vector (AV:L): The attacker must have local access to the target's network or file system, limiting the blast radius.
• Attack Complexity (AC:H): Exploitation is not trivial; specific conditions must be met, and a reliable trigger may require precise crafting.
• User Interaction (UI:R): The victim must either be capturing traffic on the targeted interface or open a malicious capture file.

Affected systems include any host running Wireshark 4.6.0–4.6.8 or 4.4.0–4.4.18. This spans enterprise analyst workstations, security operations center (SOC) analysis machines, and potentially embedded network probes that use Wireshark's dissection libraries. The blast radius is limited to the availability of the Wireshark process itself; there is no evidence of lateral movement or data compromise.

Detection Guidance

Sigma Rule

title: Wireshark CSN.1 Dissector Crash Attempt
id: 8f9c2d1e-3b4a-4c5d-9e6f-7a8b9c0d1e2f
status: experimental
description: Detects process crashes of Wireshark potentially caused by malformed CSN.1 packets.
author: Threat Intelligence
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wireshark.exe'
        ExitCode: '0xC0000005'  # Access violation
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: low

YARA Rule

rule CVE_2026_95393_CSN1_Pattern
{
    meta:
        description = "Detects potential malformed CSN.1 payloads targeting CVE-2026-95393"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-95393"
    strings:
        $csn1_magic = { 00 00 00 00 }  // Placeholder; actual CSN.1 pattern unknown
    condition:
        $csn1_magic
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-95393 Wireshark CSN.1 Dissector DoS Attempt"; content:"|00 00 00 00|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This rule uses a placeholder pattern because no specific CSN.1 malformation signature is available. Detection should be tuned based on observed malicious traffic.

Elastic Detection

process where process.name == "wireshark.exe" and process.exit_code == "0xC0000005"

Splunk SPL Query

index=windows source="WinEventLog:Application" EventCode=1000
| search "wireshark.exe" AND ("csn1" OR "CSN.1")
| table _time, host, Message

Wazuh OSSEC Rule

<rule id="100200" level="7">
  <if_sid>61600</if_sid>
  <field name="win.eventdata.image">wireshark.exe</field>
  <field name="win.eventdata.exitCode">3221225477</field>
  <description>CVE-2026-95393: Wireshark CSN.1 dissector crash detected</description>
  <mitre>
    <id>T1204</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid opening untrusted capture files in Wireshark. Use a sandboxed environment or a dedicated analysis VM without network access to the production environment.
   • When capturing live traffic, restrict access to the network segment to trusted users only.
   • Disable the CSN.1 dissector if it is not needed for routine analysis. In Wireshark, navigate to Analyze → Enabled Protocols and disable "CSN.1".
   • Use Wireshark's built-in capture filters to exclude CSN.1 traffic if possible, or apply display filters to avoid decoding unknown protocols.

2. Patch/upgrade steps:

   • No official patch is available as of this report. Monitor the Wireshark Foundation's security advisories page for updates. Once a fixed version is released, upgrade immediately.
   • If using a package manager, track the upstream release and apply updates as soon as they are available.

3. Long-term hardening:

   • Implement application whitelisting to prevent execution of unauthorized binaries, though this does not mitigate the parsing flaw.
   • Use endpoint detection and response (EDR) tools to monitor for Wireshark crashes and investigate their cause.
   • Consider running Wireshark in a containerized or sandboxed environment with limited privileges to reduce the impact of a crash.
   • Regularly train users on the risks of opening untrusted capture files.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95393
• Wireshark Security Advisories: https://www.wireshark.org/security/
• CWE-122: Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1204: User Execution: https://attack.mitre.org/techniques/T1204/
• CISA KEV Catalog: Not applicable (CVE not listed)