CVE-2026-96418

Executive Summary

CVE-2026-96418 is an infinite loop vulnerability in the TIFF protocol dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. When a user opens or processes a crafted TIFF file, the dissector enters a non-terminating loop, consuming CPU and rendering the application unresponsive, resulting in a denial-of-service condition. The vulnerability carries a CVSS score of 5.5 (Medium) and requires user interaction, but no special privileges, making it a viable nuisance and availability risk for SOC and forensic workflows that rely on Wireshark for packet and file analysis.

Technical Analysis

The flaw is classified as CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'). It resides within the TIFF protocol dissector component of Wireshark, which is responsible for parsing Tagged Image File Format (TIFF) data embedded in or captured alongside network traffic. Affected versions are Wireshark 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. According to the NVD description, the dissector enters an infinite loop when processing a specially crafted or malformed TIFF input, causing the application to hang. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates that exploitation is local (AV:L), requires no privileges (PR:N), and relies on user interaction (UI:R) — specifically, the victim must open or process a malicious TIFF file or capture. There is no confidentiality or integrity impact; the sole impact is availability (A:H) as the process becomes unresponsive and must be terminated. No further code-level details (such as specific function names or loop conditions) are provided in the available intelligence, so the exact mechanism — e.g., whether the loop is in a tag-count iteration, byte-offset progression, or nested directory parsing — cannot be confirmed from the provided data. The vulnerability is described as an infinite loop, meaning the dissector likely fails to advance a cursor or termination condition when handling malformed TIFF structures, resulting in perpetual processing. This may occur during dissection of a single packet containing TIFF data or when opening a TIFF file directly in Wireshark. The affected component is the TIFF dissector, which is part of Wireshark's extensive protocol dissector suite. Users of affected Wireshark releases who analyze untrusted TIFF content are at risk.

Exploitation Scenarios

No public proof-of-concept or exploit code is confirmed in the provided data (POC_STATUS: Public — indicates a public disclosure exists, but no exploit code was provided; PoC/Exploit field states "Public" without elaboration, and Exploit Code: NO). The attack chain is therefore inferred at the vulnerability-class level.

1. Reconnaissance/target identification: An attacker identifies a target environment where Wireshark is used to inspect network captures or analyze files that may include TIFF images — common in incident response, malware analysis, network forensics, or fuzzing pipelines. The attacker determines that the target runs an affected version (4.6.0–4.6.8 or 4.4.0–4.4.18).

2. Triggering the flaw class: The attacker crafts a malformed TIFF file, or a network packet capture containing TIFF data, designed to cause the TIFF dissector to enter an infinite loop. Because the vulnerability is an infinite loop (CWE-835), the crafted input likely contains specific structural elements (e.g., malformed directory entries, invalid offsets, or cyclic references) that cause the dissector's parsing loop to never terminate. The exact byte-level pattern is not specified in the available data.

3. Payload/execution method: The attacker delivers the malicious TIFF file or capture to the victim. Delivery vectors could include email attachments, shared drives, USB media, or a network packet capture (.pcap/.pcapng) that the analyst opens. When the victim opens the file in Wireshark or uses Wireshark to process the capture, the TIFF dissector is invoked. The infinite loop causes Wireshark to consume 100% of a CPU core and become unresponsive, potentially hanging the entire application or requiring a forced termination.

4. Post-exploitation impact: The primary impact is denial of service on the local Wireshark instance. Successful exploitation can disrupt security monitoring, incident response, or forensic analysis. Repeated or coordinated delivery of such malformed TIFF data to multiple analysts could degrade an organization’s ability to perform timely network analysis. No code execution, privilege escalation, or data exfiltration is expected based on the CVSS vector, which reports no impact to confidentiality or integrity.

Note: The EPSS score is 0.00135 (2.6th percentile), indicating a very low probability of exploitation in the wild within the next 30 days. CISA KEV status is NO, and no known active campaigns are reported. The attack chain above is strictly inferred from the vulnerability class.

Impact Assessment

The CVSS v3.1 score is 5.5 (Medium), with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Breaking this down:

• Attack Vector (AV): Local — the attacker must deliver a file or capture to the target system, or have local access to place a malicious file.
• Attack Complexity (AC): Low — no special conditions beyond user interaction.
• Privileges Required (PR): None — the attacker does not need any privileges on the target.
• User Interaction (UI): Required — the victim must open the malicious file or capture with an affected Wireshark version.
• Scope (S): Unchanged — the impact is confined to the vulnerable application.
• Confidentiality (C): None — no data exposure.
• Integrity (I): None — no data modification.
• Availability (A): High — the application becomes completely unresponsive, effectively a denial of service on the local process.

Business impact: Organizations relying on Wireshark for network troubleshooting, security monitoring, or forensic investigations may experience workflow disruption if an analyst opens a malicious TIFF file. Blast radius is limited to the local Wireshark instance on the user's machine; there is no lateral movement or server-side impact. However, in environments where Wireshark runs on shared analysis workstations, repeated incidents could cause operational delays. Because patching is straightforward and the likelihood of exploitation is low, overall risk is moderate but easily mitigated.

Detection Guidance

Sigma Rule

title: Wireshark TIFF Dissector Infinite Loop DoS Attempt
id: 6e2b5c3a-4d1f-4a7b-9c8e-1f2a3b4c5d6e
status: experimental
description: Detects potential exploitation of CVE-2026-96418 via a malformed TIFF file causing Wireshark to hang.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-96418
author: Valters IT Threat Intelligence
date: 2026-05-12
tags:
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
        CommandLine|contains:
            - '.tif'
            - '.tiff'
    condition: selection
fields:
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Legitimate analysis of TIFF files
level: low

YARA Rule

rule CVE_2026_96418_Wireshark_TIFF_DoS
{
    meta:
        description = "Detects malformed TIFF files that may trigger CVE-2026-96418 in Wireshark TIFF dissector"
        author = "Valters IT Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96418"
        hash = "unknown"
    strings:
        $tiff_le = { 49 49 2A 00 }
        $tiff_be = { 4D 4D 00 2A }
        $tiff_bigtiff_le = { 49 49 2B 00 }
        $tiff_bigtiff_be = { 4D 4D 00 2B }
    condition:
        ($tiff_le at 0 or $tiff_be at 0 or $tiff_bigtiff_le at 0 or $tiff_bigtiff_be at 0) and
        filesize < 10MB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-96418 Wireshark TIFF Dissector Infinite Loop DoS Attempt"; flow:to_client,established; file_data; content:"|49 49 2A 00|"; depth:4; content:"|4D 4D 00 2A|"; depth:4; distance:0; within:4; classtype:attempted-dos; sid:9000001; rev:1; reference:cve,2026-96418;)

Elastic Detection

process where process.name in ("wireshark", "wireshark.exe", "tshark", "tshark.exe") and
process.args : ("*.tif", "*.tiff")

Splunk SPL Query

index=windows OR index=linux sourcetype=WinEventLog OR sourcetype=syslog
(process_name="wireshark.exe" OR process_name="tshark.exe" OR process_name="wireshark" OR process_name="tshark")
| search (CommandLine="*.tif" OR CommandLine="*.tiff" OR process="wireshark")
| stats count by host, user, process_name, CommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="wireshark,">
  <rule id="100200" level="6">
    <decoded_as>windows_eventchannel</decoded_as>
    <field name="win.eventdata.image">wireshark\.exe$|tshark\.exe$</field>
    <field name="win.eventdata.commandLine">\.tif$|\.tiff$</field>
    <description>CVE-2026-96418: Wireshark/tshark executed with TIFF file - possible infinite loop DoS attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix).

1. Immediate mitigations:

   • Avoid opening untrusted TIFF files or packet captures containing TIFF data with affected Wireshark versions.
   • Use isolated/air-gapped analysis environments or disposable VMs for processing suspicious files.
   • Monitor Wireshark processes for hangs or excessive CPU usage; implement process timeouts where feasible.

2. Patch/upgrade steps:

   • Upgrade to Wireshark 4.6.9 or 4.4.19 (the versions that contain the fix, per OSV and Debian references).
   • Follow vendor instructions for your operating system or package manager (e.g., apt, dnf, or the official Wireshark installer).
   • Verify the installed version via Help → About Wireshark or wireshark -v.

3. Long-term hardening:

   • Enforce a policy of patching network analysis tools promptly; subscribe to Wireshark security advisories.
   • Limit use of Wireshark with elevated privileges; run as an unprivileged user.
   • Consider sandboxing for file analysis and using dedicated analysis VMs that can be reset.
   • Train analysts to recognize social engineering attempts that deliver malformed media files.

References

1. NVD — CVE-2026-96418: https://nvd.nist.gov/vuln/detail/CVE-2026-96418
2. Wireshark Security Advisories: https://www.wireshark.org/security/
3. OSV Entry for CVE-2026-96418 (package references): https://osv.dev/vulnerability/CVE-2026-96418
4. Debian Security Tracker — CVE-2026-96418: https://security-tracker.debian.org/tracker/CVE-2026-96418
5. CWE-835: Loop with Unreachable Exit Condition: https://cwe.mitre.org/data/definitions/835.html

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at this time. EPSS score is 0.00135, indicating a low likelihood of exploitation.