CVE-2026-96417

Executive Summary

CVE-2026-96417 is a heap-based buffer overflow (CWE-122) in the RF4CE protocol dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker who can deliver a malformed RF4CE packet to a victim and convince them to open or capture that traffic with an affected Wireshark build can trigger a dissector crash, causing a denial of service. The vulnerability is local in attack vector, requires user interaction, and has no impact on confidentiality or integrity, but fully compromises availability (CVSS 5.5, A:H).

Technical Analysis

Wireshark is a widely deployed network protocol analyzer used by network engineers, security analysts, and incident responders to capture and inspect packet traffic. Its dissector framework parses hundreds of protocols, including RF4CE (Radio Frequency for Consumer Electronics), a Zigbee-based protocol used for remote controls and consumer electronics command traffic.

The vulnerability is classified as CWE-122, Heap-based Buffer Overflow, and resides within the RF4CE protocol dissector. A heap-based buffer overflow occurs when a program writes more data to a heap-allocated buffer than the buffer was sized to hold. In the context of a protocol dissector, this typically arises when a length or count field taken from the packet is trusted and used to index or copy data into a fixed-size heap allocation without adequate bounds validation. When the crafted packet supplies inconsistent or oversized length values, the dissector writes beyond the allocated region.

The affected components are Wireshark 4.6.0–4.6.8 and 4.4.0–4.4.18. Because the flaw is in the dissector, it is reachable whenever RF4CE traffic is parsed — either from a live capture interface or from a previously saved capture file (pcap/pcapng) that is opened in the application. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates the attacker must get a crafted capture or live traffic in front of the victim and rely on the victim to open it; no privileges are required and no authentication is needed. The outcome described by the CNA is a dissector crash resulting in denial of service.

No function names, structure names, or code paths are provided in the available NVD description, so a precise line-level root cause cannot be stated without fabrication. What can be stated with confidence is the vulnerability class (heap overflow), the affected subsystem (RF4CE dissector), the affected version ranges, and the availability-only impact.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-96417, and no evidence of exploitation in the wild exists. The attack chain below is inferred strictly from the vulnerability class and the metadata provided.

1. Reconnaissance / target identification: The attacker identifies a target environment that uses Wireshark for traffic analysis, or identifies an analyst who routinely opens capture files received from external parties, mailing lists, or shared repositories. The attacker does not need network reachability to the analyst's host; delivery is via the capture artifact itself.

2. Triggering the flaw class: The attacker crafts an RF4CE packet (or a capture file containing one) in which a length or count field is inconsistent with the actual data carried, so that the dissector's heap-based buffer handling overflows when the packet is parsed. Because this is a heap-based buffer overflow, the trigger is malformed input that exceeds the bounds of a heap allocation made by the dissector.

3. Payload / execution method: The attacker delivers the malicious capture file through a channel the victim trusts — email attachment, shared drive, ticketing system, paste site, or a live RF4CE transmission in radio range of a monitoring sensor feeding Wireshark. The victim opens the file or starts a capture, and Wireshark parses the RF4CE traffic, reaching the vulnerable code path.

4. Post-exploitation impact: The immediate effect is a crash of the dissector/application, producing a denial of service for the analyst's capture and analysis workflow. The CVSS vector rates availability impact as High with no confidentiality or integrity impact; the CNA title describes the outcome as a denial of service. No code execution or data exfiltration is claimed by the available data.

Impact Assessment

The CVSS 3.1 base score is 5.5 (Medium). Subscore analysis:

• Attack Vector (AV:L, Local): the attacker cannot exploit this remotely against the Wireshark process by itself; the malicious content must be delivered as a file or as traffic the victim chooses to capture/parse. This limits mass-exploitation potential.
• Attack Complexity (AC:L, Low): once the crafted input is delivered and opened, no special conditions or race windows are required.
• Privileges Required (PR:N, None): no authentication or elevated privileges are needed.
• User Interaction (UI:R, Required): the victim must open the capture file or run a capture that includes the malformed traffic.
• Scope (S:U, Unchanged): the impact is confined to the vulnerable Wireshark component.
• Confidentiality (C:N, None) and Integrity (I:N, None): no data disclosure or modification.
• Availability (A:H, High): the dissector crashes, denying service to the analyst and interrupting capture/analysis operations.

Business impact centers on availability of the traffic-analysis tool itself. In security operations centers, incident response engagements, and network troubleshooting workflows, a crashed analyzer can interrupt active investigations and delay triage. The blast radius is limited to hosts running the affected Wireshark versions that process RF4CE traffic, but the practical risk is that an analyst can be denied their primary investigative tool during a time-sensitive event. Because user interaction is required and the attacker must control input the victim opens, this is primarily a targeted nuisance/DoS vector rather than a wormable or remote-code-execution threat.

Detection Guidance

Sigma Rule

title: Wireshark RF4CE Dissector Heap Overflow Crash Attempt (CVE-2026-96417)
id: 3f9a1c2e-7b64-4d21-9c0a-96417aabbccd
status: experimental
description: Detects Wireshark process crashes consistent with the RF4CE dissector heap-based buffer overflow when parsing malformed capture data.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96417
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_crash:
    - ExitCode: '0xc0000005'
    - ExitCode: '3221225477'
    - ExitCode: '0xc0000374'
    - ExitCode: '3221226356'
  condition: selection_img and selection_crash
falsepositives:
  - Legitimate crashes from unrelated dissectors
  - Out-of-memory conditions unrelated to malformed RF4CE input
level: medium
tags:
  - attack.t1499
  - cve.2026.96417

YARA Rule

rule CVE_2026_96417_RF4CE_Capture_Indicator
{
    meta:
        description = "Flags capture files referencing RF4CE traffic that may carry malformed dissector input (CVE-2026-96417)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96417"
        cve = "CVE-2026-96417"

    strings:
        $pcap_le = { d4 c3 b2 a1 }
        $pcap_be = { a1 b2 c3 d4 }
        $pcapng  = { 0a 0d 0d 0a }
        $rf4ce1  = "RF4CE" ascii nocase
        $rf4ce2  = "rf4ce" ascii
        $zigbee  = "zigbee" ascii nocase

    condition:
        ($pcap_le at 0 or $pcap_be at 0 or $pcapng at 0) and
        (any of ($rf4ce*) or $zigbee)
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-96417 Wireshark RF4CE dissector potential malformed packet (DoS)"; \
  flow:stateless; \
  content:"RF4CE"; nocase; \
  byte_test:1,>,200,0,relative; \
  threshold:type limit, track by_src, count 1, seconds 60; \
  classtype:attempted-dos; \
  reference:cve,CVE-2026-96417; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96417; \
  metadata:service rf4ce; \
  sid:900964170; rev:1;)

Elastic Detection

process where event.type == "end" and
  process.name in ("wireshark.exe", "tshark.exe", "dumpcap.exe") and
  process.exit_code in ("0xC0000005", "0xC0000374", "3221225477", "3221226356")

Splunk SPL Query

index=endpoint (Image="*\\wireshark.exe" OR Image="*\\tshark.exe" OR Image="*\\dumpcap.exe")
| eval crash=if(ExitCode IN ("0xC0000005","0xC0000374","3221225477","3221226356"),1,0)
| where crash=1
| stats count values(CommandLine) as cmdlines values(User) as users by host Image ExitCode
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-96417,">
  <rule id="100617" level="7">
    <if_sid>61613</if_sid>
    <field name="win.eventdata.image">wireshark\.exe|tshark\.exe|dumpcap\.exe</field>
    <field name="win.eventdata.exitCode">0xC0000005|0xC0000374|3221225477|3221226356</field>
    <description>CVE-2026-96417: Possible Wireshark RF4CE dissector heap overflow crash (malformed capture input)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Avoid opening untrusted or unsolicited capture files (pcap/pcapng) in affected Wireshark builds.
• Treat capture files received via email, shared drives, or external repositories as untrusted input; inspect them in an isolated/sandboxed environment first.
• If RF4CE analysis is not required, avoid enabling or exercising RF4CE-related capture workflows on the affected versions.
• Run Wireshark in a dedicated analysis VM so a dissector crash does not affect the analyst's primary workstation, and enable automatic crash recovery/session autosave to reduce data loss from a crash.
• Do not attach live RF4CE capture sensors to production analysis hosts running affected versions without isolation.

2. Patch/upgrade steps:

• No vendor patch or fixed version has been confirmed by any tracked source. Monitor the Wireshark security advisories page for a release that addresses the RF4CE dissector issue in the 4.6.x and 4.4.x branches.
• When a fixed release is published, upgrade all Wireshark installs (and any packaged tshark/dumpcap deployments) to that version, and verify the version string post-upgrade.
• Where a fixed version is unavailable but the feature is non-essential, consider disabling/limiting the ability to parse RF4CE content until a fix is released.

3. Long-term hardening:

• Maintain a vulnerability management process that tracks Wireshark dissector CVEs and applies vendor releases promptly; keep laboratory capture tooling on a short upgrade cadence.
• Stand up isolated capture-analysis workstations with restricted local privilege and no access to sensitive production networks.
• Enforce a policy that capture files from external sources are sanitized or reviewed before being opened in primary tooling.

References

• NVD — CVE-2026-96417: https://nvd.nist.gov/vuln/detail/CVE-2026-96417
• Wireshark Security Advisories: https://www.wireshark.org/security/
• CWE-122, Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1499, Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog (not listed for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-96417 at the time of writing. EPSS has not yet been scored by FIRST.org for this CVE; no EPSS value is fabricated here.