CVE-2026-96416

Executive Summary

CVE-2026-96416 is a denial-of-service (DoS) vulnerability in the IEEE 802.11 protocol dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a crash by inducing a user to open a crafted packet capture file, causing the dissector to enter an invalid state and terminate the application. This affects any organization or individual using the listed Wireshark versions for network analysis, incident response, or forensic investigations, and although the CVSS score is moderate (5.5), the loss of availability can disrupt critical security monitoring workflows.

Technical Analysis

The vulnerability resides in the IEEE 802.11 protocol dissector, a component responsible for parsing wireless network frames captured in monitor mode or provided in packet capture (pcap/pcapng) files. According to the NVD description, the issue is a heap-based buffer overflow (CWE-122) that leads to an application crash, resulting in a denial-of-service condition. The dissector fails to properly validate the length of a field or the number of elements within an 802.11 frame, allowing a malformed packet to cause out-of-bounds memory access.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates that the attack is local (AV:L), requires no privileges (PR:N), and relies on user interaction (UI:R) — specifically, the victim must open a malicious capture file. The attack complexity is low (AC:L), and the impact is solely to availability (A:H), with no effect on confidentiality or integrity (C:N/I:N/A:H). The scope is unchanged (S:U), meaning the vulnerability cannot affect resources beyond the Wireshark process itself.

Because the CNA title and NVD description are sparse and provide no specific function names, variable names, or code paths, the exact mechanism of the buffer overflow (e.g., which information element or frame subtype triggers it) cannot be determined from the available data. The vulnerability class — heap buffer overflow in a protocol dissector — is well-known in Wireshark's history, typically arising from incorrect length calculations or missing bounds checks when parsing variable-length fields. Attackers can exploit this by crafting a capture file containing a malformed 802.11 frame that causes the dissector to write beyond the allocated buffer, leading to a crash (and potentially, in some cases, memory corruption that could be leveraged further, though no evidence of code execution is present in the CVSS metrics).

The attack surface is limited to the parsing of capture files; live capture from a wireless interface is also theoretically affected if the malformed frame is received over the air. However, the user interaction requirement means that an attacker must deliver the malicious file and convince the user to open it.

Exploitation Scenarios

Based on the NVD description, exploitation follows this general chain:

1. Reconnaissance/target identification: The attacker identifies a target running Wireshark 4.6.0–4.6.8 or 4.4.0–4.4.18. This may be an individual analyst, a security operations center (SOC) analyst, or a forensic investigator who regularly opens untrusted capture files.

2. Triggering the flaw: The attacker crafts a packet capture file (pcap or pcapng) containing one or more IEEE 802.11 frames that are malformed in a way that triggers the heap buffer overflow. The specific malformation is not described in the available data, but it likely involves an invalid length field or a crafted information element that causes the dissector to read/write beyond allocated memory.

3. Payload/execution method: The attacker delivers the crafted file via email, a file-sharing service, or a compromised repository. The victim must open the file in Wireshark. Upon opening, the 802.11 dissector processes the malicious frame, triggering the overflow. The application crashes, resulting in a denial of service. No public proof-of-concept (PoC) is known, and the attack chain is inferred from the vulnerability class.

4. Post-exploitation impact: The immediate impact is the unavailability of Wireshark, disrupting the victim's ability to analyze network traffic. In a critical incident response scenario, this could delay threat detection and response. The CVSS score indicates no loss of confidentiality or integrity, and the scope is unchanged, so the attacker cannot directly compromise other system resources through this vulnerability alone.

No public exploit code, Nuclei template, or evidence of exploitation in the wild is available as of this report.

Impact Assessment

The business impact is primarily operational: a crash of Wireshark interrupts network analysis, forensic investigation, or security monitoring tasks. For organizations that rely on Wireshark for real-time traffic inspection or incident response, this could lead to delays in identifying and mitigating active threats. The blast radius is limited to the individual user session that opens the malicious file; there is no lateral movement or server-side impact, as the vulnerability is local and requires user interaction. The CVSS score of 5.5 reflects a moderate severity, with high availability impact but no confidentiality or integrity impact. The EPSS score is not yet available, and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at this time.

Detection Guidance

Sigma Rule

title: Wireshark 802.11 Dissector Crash Attempt
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects the opening of a packet capture file that may trigger CVE-2026-96416 in Wireshark 4.6.0-4.6.8 or 4.4.0-4.4.18.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: '\Wireshark.exe'
    CommandLine|contains: '.pcap'
  condition: selection
falsepositives:
  - Legitimate opening of pcap files by analysts
level: low
tags:
  - attack.t1190
  - cve.2026.96416

YARA Rule

rule CVE_2026_96416_Wireshark_80211_Crash
{
    meta:
        description = "Detects malformed IEEE 802.11 frames in packet capture files that may trigger CVE-2026-96416"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96416"
        hash = "unknown"
    strings:
        $pcap_magic_le = { d4 c3 b2 a1 }
        $pcap_magic_be = { a1 b2 c3 d4 }
        $pcapng_magic = { 0a 0d 0d 0a }
        $ieee80211_type_mgmt = { 00 ?? }
        $ieee80211_type_ctrl = { 01 ?? }
        $ieee80211_type_data = { 02 ?? }
    condition:
        (
            $pcap_magic_le at 0 or
            $pcap_magic_be at 0 or
            $pcapng_magic at 0
        ) and
        any of ($ieee80211_type_*)
}

Note: This YARA rule provides a heuristic match for capture files containing 802.11 frames. It may produce false positives; tuning is required.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-96416 Wireshark 802.11 Dissector Crash Attempt - Malformed 802.11 Frame in Pcap"; flow:to_client,established; file_data; content:"|d4 c3 b2 a1|"; depth:4; content:"|00 00|"; distance:0; within:2; content:"|08 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|ff ff ff ff ff ff|"; distance:0; within:6; content:"|00 00 00 00 00 00|"; distance:0; within:6; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; content:"|00 00|"; distance:0; within:2; classtype:attempted-dos; sid:10000001; rev:1;)

Note: This rule is a heuristic placeholder and does not represent a validated signature for the specific malformed frame. Network-based detection of this local file-open vulnerability is inherently limited.

Elastic Detection

process where event.type == "start" and process.name == "Wireshark.exe" and process.args : "*.pcap*"

Note: This EQL query detects the execution of Wireshark with a pcap file argument. It is a generic detection and not specific to CVE-2026-96416.

Splunk SPL Query

index=windows EventCode=4688 Image="*\\Wireshark.exe" CommandLine="*.pcap*"
| stats count by ComputerName, User, CommandLine
| where count > 0

Note: This query identifies Wireshark process executions with pcap files. It does not detect the specific malformed frame and should be used as a baseline for further investigation.

Wazuh OSSEC Rule

<group name="windows, sysmon,">
  <rule id="100001" level="3">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">Wireshark.exe</field>
    <field name="win.eventdata.commandLine">\.pcap</field>
    <description>CVE-2026-96416: Wireshark opened a pcap file - possible attempt to trigger 802.11 dissector crash</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: This rule triggers on Wireshark process creation with a pcap file argument. It is a low-fidelity indicator and requires correlation with other events.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid opening untrusted packet capture files with Wireshark versions 4.6.0–4.6.8 or 4.4.0–4.4.18. Use alternative tools such as tcpdump or tshark with caution, or open files in a sandboxed environment.
   • Implement application allowlisting to restrict Wireshark execution to trusted users and contexts.
   • Enable Wireshark's built-in crash reporting to monitor for unexpected terminations.
   • Train users to verify the source of capture files before opening them.

2. Patch/upgrade steps:

   • No official patch is available as of this report. Monitor the Wireshark Foundation's security advisories page for updates.
   • Once a patched version is released, upgrade to the latest stable release (e.g., 4.6.9 or 4.4.19 or later) immediately.
   • If upgrading is not possible, consider using an older version not affected by this vulnerability, if available and supported.

3. Long-term hardening:

   • Enforce a policy of opening capture files only from trusted sources.
   • Deploy endpoint detection and response (EDR) solutions to detect anomalous Wireshark crashes or memory corruption indicators.
   • Participate in Wireshark's security announcement mailing list to receive timely patch notifications.
   • Regularly review and update network analysis tooling as part of vulnerability management.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96416
• Wireshark Security Advisories: https://www.wireshark.org/security/
• CWE-122: Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.