CVE-2026-96415

Executive Summary

CVE-2026-96415 is a stack-based buffer overflow (CWE-121) in the Catapult DCT2000 protocol dissector shipped with Wireshark. Versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are affected. Exploitation requires a user to open a crafted packet capture file or capture live traffic containing a malformed DCT2000 packet, resulting in a crash that causes denial of service against the Wireshark process. The CVSS score is 5.5 (Medium) with availability impact rated High.

Technical Analysis

The vulnerability is classified as CWE-121, a Stack-based Buffer Overflow. The NVD description states that the "Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service." This identifies the exact subsystem at fault: the protocol dissector responsible for parsing Catapult DCT2000 traffic within the affected Wireshark versions.

Dissectors in Wireshark are the per-protocol parsers that translate raw bytes from a capture into structured protocol fields. A stack-based buffer overflow in a dissector means that parsing logic writes attacker-controlled data past the boundary of a fixed-size stack buffer. The NVD description does not disclose the specific field, packet structure, or code path involved, so the precise trigger condition cannot be stated. At the vulnerability-class level: a malformed or oversized DCT2000 packet causes the dissector to copy or compute a value that exceeds the bounds of a stack-allocated buffer, corrupting adjacent stack memory.

The relevant attack surface is the parsing pipeline reached whenever Wireshark (or a tool reusing its dissection libraries such as tshark) processes DCT2000 protocol data. Entry points include opening a saved capture file, reading from a live interface, or any automated pipeline that feeds capture data to the dissector.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates: Local attack vector (AV:L), Low attack complexity (AC:L), no privileges required (PR:N), and User Interaction required (UI:R) — consistent with a victim needing to open a malicious capture file. Scope is Unchanged (S:U), Confidentiality and Integrity impacts are None, and Availability impact is High (A:H), matching the denial-of-service outcome. CWE-121 classifies this as memory corruption, which in some configurations can be escalated beyond a simple crash depending on memory layout and allocator behavior; however, the CVSS subscores assigned here reflect only an availability impact.

The NVD description and provided data do not include function names, buffer sizes, offsets, or the specific DCT2000 frame field responsible. Any claim of a specific overwritten field or copying routine would be unsupported and is therefore omitted.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-96415. The attack chain below is inferred strictly from the vulnerability class (stack buffer overflow in a protocol dissector) and the data provided.

1. Reconnaissance / target identification: An adversary identifies environments where Wireshark 4.6.0–4.6.8 or 4.4.0–4.4.18 is used to analyze traffic. Targets are typically security analysts, network engineers, incident responders, or automated capture-processing pipelines (for example, tshark invoked in a script). The adversary determines whether DCT2000 traffic or capture files are likely to be processed, since the dissector is only reached when DCT2000 protocol data is present.

2. Triggering the flaw class: The adversary constructs or obtains a capture containing a malformed Catapult DCT2000 packet. Because the defect is a stack-based buffer overflow, the malicious packet supplies data that causes the dissector's parsing logic to write beyond a fixed-size stack buffer. The specific malformed field is not disclosed in the available data, so the exact byte pattern cannot be described.

3. Payload / execution method: The crafted capture file is delivered to the victim through a lure — for example, a shared pcap in a ticket, an email attachment, or a capture published to a repository — or a live traffic stream carrying DCT2000 packets is presented to a monitoring interface. When the victim opens the file or the capture is processed, Wireshark (or tshark) invokes the vulnerable DCT2000 dissector and the overflow occurs.

4. Post-exploitation impact: Per the NVD description, the outcome is denial of service — a crash of the application processing the capture. The CVSS subscores show no confidentiality or integrity impact. Because CWE-121 denotes memory corruption, the practical consequence in the assessed scope is process termination and potential loss of an in-progress capture session; broader impact beyond DoS is not evidenced by the provided data.

Impact Assessment

The primary impact is availability loss. A successful trigger crashes the affected Wireshark process, terminating the analysis session and potentially causing loss of unsaved captured data. The CVSS base score is 5.5 (Medium).

Subscore interpretation:

• Attack Vector (Local, AV:L): the adversary must deliver the malicious capture or traffic to the victim's local environment.
• Attack Complexity (Low, AC:L): no special conditions beyond supplying the malformed DCT2000 data are indicated.
• Privileges Required (None, PR:N): no prior authentication or privileges on the target host are needed.
• User Interaction (Required, UI:R): a victim must open the crafted file or otherwise cause the DCT2000 dissector to run.
• Scope (Unchanged, S:U): exploitation is confined to the vulnerable application.
• Confidentiality (None) / Integrity (None): no evidence of data disclosure or modification.
• Availability (High, A:H): the process becomes unavailable.

Blast radius is limited to systems running the affected Wireshark versions that process DCT2000 traffic. Environments relying on continuous capture analysis could experience interruption of monitoring workflows. CISA KEV does not list this CVE, and EPSS has not yet been scored, so no evidence of active exploitation is present in the provided data.

Detection Guidance

Sigma Rule

title: Potential Wireshark Catapult DCT2000 Dissector DoS (CVE-2026-96415)
id: 5c1f9d2a-7b3e-4f21-9a0d-0cve202696415
status: experimental
description: Detects crashes of Wireshark/tshark processes that may indicate exploitation of the Catapult DCT2000 dissector stack buffer overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96415
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\wireshark.exe'
        - '\tshark.exe'
  selection_susp:
    CommandLine|contains:
      - 'dct2000'
  condition: selection_img and selection_susp
falsepositives:
  - Legitimate analysis of DCT2000 protocol captures
level: medium
tags:
  - attack.t1203
  - cve.2026.96415

YARA Rule

rule CVE_2026_96415_Catapult_DCT2000_Marker
{
    meta:
        description = "Detects capture files referencing Catapult DCT2000 protocol potentially crafted to trigger CVE-2026-96415"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96415"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $dct = "DCT2000" ascii nocase
        $cat = "Catapult" ascii nocase
        $pcap = { d4 c3 b2 a1 }
        $pcapng = { 0a 0d 0d 0a }

    condition:
        ($dct or $cat) and ($pcap at 0 or $pcapng at 0)
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-96415 Potential Catapult DCT2000 Dissector Exploit Traffic"; content:"DCT2000"; nocase; classtype:attempted-dos; reference:cve,2026-96415; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96415; sid:202696415; rev:1;)

Elastic Detection

process where process.name in ("wireshark.exe", "tshark.exe") and process.command_line : "*dct2000*"

Splunk SPL Query

index=endpoint (Image="*\\wireshark.exe" OR Image="*\\tshark.exe") (CommandLine="*dct2000*" OR CommandLine="*DCT2000*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, CommandLine
| sort - last_seen

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-96415,">
  <rule id="202696415" level="8">
    <if_sid>5920</if_sid>
    <field name="win.eventdata.image">wireshark.exe|tshark.exe</field>
    <match>dct2000</match>
    <description>CVE-2026-96415: Possible Wireshark Catapult DCT2000 dissector exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data was provided.

1. Immediate mitigations:

• Avoid processing untrusted or unsolicited packet capture files (pcap/pcapng) with affected Wireshark versions.
• Where DCT2000 analysis is not required, disable or avoid loading the DCT2000 protocol dissector to reduce exposure. Confirm the exact mechanism for disabling dissectors against the installed version's documentation before relying on it.
• Isolate capture-analysis workstations and run Wireshark/tshark with least privilege to limit the effects of a crash.
• Treat capture files from external sources as untrusted input and validate their origin.

2. Patch / upgrade steps:

• No patch is currently identified in any tracked source. Monitor the Wireshark security advisories portal for an updated release beyond 4.6.8 and 4.4.18.
• When a fixed version is published, upgrade all affected installations and any tooling that bundles the Wireshark dissection libraries (for example tshark and dependent pipelines).
• Re-test capture-processing workflows after upgrading to confirm the DCT2000 dissector no longer crashes on previously malformed inputs.

3. Long-term hardening:

• Establish a routine patch cadence for Wireshark and its bundled libraries across analyst endpoints and automated pipelines.
• Use input handling controls that sandbox or restrict file parsing, and prefer running packet analysis in disposable or constrained environments.
• Track CVE feeds and vendor advisories for dissector-related memory-safety issues, which recur across protocol parsers.
• Apply defense-in-depth monitoring (see Detection Guidance) to surface crashes and suspicious DCT2000 capture processing.

References

• NVD — CVE-2026-96415: https://nvd.nist.gov/vuln/detail/CVE-2026-96415
• Wireshark Security Advisories: https://www.wireshark.org/security/
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-96415 not yet scored)

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-96415 in the provided data. CISA KEV does not list this CVE.