CVE-2026-96421

Executive Summary

CVE-2026-96421 is a denial-of-service vulnerability in the USB HID protocol dissector shipped with Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The flaw manifests as an infinite loop coupled with a memory leak, classified under CWE-1325 (Improperly Controlled Sequential Memory Allocation). An attacker who can supply a crafted USB HID capture file or inject malformed USB HID traffic onto a monitored interface can force the dissector into non-terminating execution and unbounded memory consumption, leading to application hang, resource exhaustion, or crash. The CVSS v3.1 score of 5.5 (Medium) reflects a local attack vector requiring user interaction, with high availability impact and no confidentiality or integrity impact.

Technical Analysis

The vulnerability resides in the USB HID protocol dissector — the Wireshark component responsible for parsing Human Interface Device traffic (keyboards, mice, gamepads, and similar peripherals) carried over USB. Per the NVD description, the defect is characterized by two combined weaknesses:

1. Infinite loop — the dissection routine does not converge on a terminating condition when processing certain malformed or specially crafted USB HID packet structures. Once entered, the dissector loop fails to exit, consuming CPU indefinitely and freezing the GUI or blocking the capture-analysis pipeline.

2. Memory leak — simultaneously, memory is allocated repeatedly within the looping path without being freed. Because the loop does not terminate, allocation continues unbounded, progressively exhausting available process memory.

CWE-1325 ("Improperly Controlled Sequential Memory Allocation") describes precisely this pattern: an application performs sequential memory allocations based on attacker-influenced input without adequately bounding the total allocation or iteration count. In a protocol dissector context, this typically means a length, count, or descriptor field within the HID payload is trusted to drive an allocation/iteration loop without validation against the actual remaining buffer size or an absolute ceiling.

Attack surface: The USB HID dissector is reachable via two primary paths:

• Offline analysis: opening a malicious .pcap/.pcapng capture file containing crafted USB HID records (the UI:R user-interaction vector in the CVSS metric corresponds to the victim opening the file).
• Live capture: capturing on a USB interface (e.g., usbmon on Linux, USBPcap on Windows) while malformed USB HID traffic is present on the monitored bus.

Code-level detail: The NVD description does not disclose specific function names, file paths, or field identifiers. The dissector source file and the exact malformed field triggering the loop are not provided in the available intelligence. Any claim of a specific function name or structure field would be speculative and is therefore not asserted here.

The local attack vector (AV:L) and low complexity (AC:L) indicate that exploitation requires the attacker to deliver the crafted artifact locally (file or local capture interface) with no special privileges (PR:N), but the victim must perform an action such as opening the file or initiating a capture (UI:R). The scope is unchanged (S:U), meaning the impact is confined to the Wireshark process and does not escalate to the host kernel.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-96421. The attack chain below is inferred at the vulnerability-class level from the NVD description and should be treated as a capability model, not a validated exploit recipe.

1. Reconnaissance / target identification. The attacker identifies a target environment where Wireshark (a vulnerable 4.4.x or 4.6.x build) is used for USB traffic analysis — common in embedded development, hardware security testing, forensic labs, and incident-response workstations. The attacker does not need network reachability; they need to deliver an artifact the analyst will process.

2. Triggering the flaw class. The attacker crafts a capture file — or generates USB HID bus traffic — containing malformed USB HID data whose internal structure drives the dissector into a non-terminating iteration with repeated allocation. The precise malformed field is not disclosed; per CWE-1325, the trigger is a count/length/descriptor value that is not validated against an upper bound or the actual buffer contents. When the victim opens the capture (or captures the live bus), the dissector enters the infinite loop and begins leaking memory.

3. Payload / execution method. At the vulnerability-class level, delivery is via a poisoned .pcap/.pcapng file (e.g., attached to a phishing email, shared in a collaborative repository, or planted on a compromised analysis host) or via a malicious USB-device emulator (e.g., a programmable USB HID gadget) monitored during a live capture. No shellcode, code execution, or privilege escalation is involved — the payload is data that induces resource exhaustion only.

4. Post-exploitation impact. The expected outcome is denial of service against the analyst's tooling: the Wireshark process hangs or crashes, associated capture files may be corrupted (partial writes), and the host may experience memory pressure if the leak continues long enough. There is no follow-on code execution, data exfiltration, or lateral movement attributable to this CVE. The operational effect is loss of visibility and analyst productivity, potentially during a time-sensitive investigation.

Impact Assessment

• Availability (A:H): The primary and only impact dimension. The infinite loop renders Wireshark unresponsive; the memory leak can exhaust process and, in extreme cases, system memory. This directly degrades an organization's network/endpoint analysis capability.
• Confidentiality (C:N) / Integrity (I:N): No disclosure or modification of data is demonstrated by this flaw.
• Attack vector (AV:L) / complexity (AC:L) / privileges (PR:N) / user interaction (UI:R): Exploitation is local and low-complexity but requires the victim to open a malicious capture or initiate capture on an affected interface — a realistic social-engineering or supply-chain vector for analyst workstations.
• Scope (S:U): Impact remains within the Wireshark process boundary.
• Business impact: For security operations centers, forensic teams, and embedded/hardware engineers, a hung or crashed capture tool interrupts live incident response, delays forensic timelines, and can cause loss of volatile capture evidence. Repeated crashes may push teams to disable the USB HID dissector entirely, reducing analytical coverage.
• Blast radius: Limited to individual Wireshark installations processing the malicious artifact. No KEV listing, no known in-the-wild exploitation, and no wormable or self-propagating behavior. Enterprise-wide exposure is proportional to how many analyst endpoints run affected versions and routinely process untrusted captures.

Detection Guidance

Sigma Rule

title: Wireshark USB HID Dissector Denial of Service (CVE-2026-96421)
id: 8f3c1a72-9d4e-4b6a-a1c2-7e5f0b3d9a44
status: experimental
description: Detects Wireshark process hangs or crashes indicative of the USB HID dissector infinite loop / memory leak triggered by a malformed capture file.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96421
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_args:
    CommandLine|contains:
      - '.pcap'
      - '.pcapng'
      - 'usbmon'
      - 'USBPcap'
  condition: selection_image and selection_args
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate capture analysis of USB traffic by authorized analysts
level: low
tags:
  - attack.t1499
  - cve.2026.96421

YARA Rule

rule CVE_2026_96421_Wireshark_USB_HID_DoS
{
    meta:
        description = "Detects USB HID capture artifacts associated with CVE-2026-96421 infinite loop / memory leak"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96421"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pcapng_magic = { 0A 0D 0D 0A }
        $pcap_le      = { D4 C3 B2 A1 }
        $pcap_be      = { A1 B2 C3 D4 }
        $usb_hid      = "USB HID" ascii nocase
        $hid_keyboard = "HID Keyboard" ascii nocase
        $usbmon       = "usbmon" ascii nocase

    condition:
        (uint32(0) == 0x0A0D0D0A or $pcap_le at 0 or $pcap_be at 0) and
        any of ($usb_hid, $hid_keyboard, $usbmon) and
        filesize < 100MB
}

Suricata IDS Rule

alert usb any any -> any any (msg:"CVE-2026-96421 Wireshark USB HID dissector DoS - malformed HID descriptor capture"; flow:stateless; content:"|0A 0D 0D 0A|"; depth:4; content:"USB HID"; nocase; classtype:attempted-dos; reference:cve,2026-96421; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96421; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202696421; rev:1;)

Elastic Detection

process where process.name in ("wireshark.exe", "tshark.exe", "dumpcap.exe")
and process.args : ("*.pcap", "*.pcapng", "*usbmon*", "*USBPcap*")

Correlate with a follow-on event where the process stops responding or exits with a non-zero code, or with host memory pressure spikes coincident with the capture-analysis process.

Splunk SPL Query

index=endpoint (process_name=wireshark.exe OR process_name=tshark.exe OR process_name=dumpcap.exe)
(CommandLine="*.pcap*" OR CommandLine="*usbmon*" OR CommandLine="*USBPcap*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as command_lines by host, process_name, user
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - last_seen

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-96421,">
  <rule id="2026964" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">wireshark\.exe|tshark\.exe|dumpcap\.exe</field>
    <field name="process.args">\.pcap|\.pcapng|usbmon|USBPcap</field>
    <description>CVE-2026-96421: Wireshark USB HID capture analysis started on untrusted artifact - potential dissector DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>

  <rule id="2026965" level="10">
    <if_sid>2026964</if_sid>
    <field name="event.outcome">crash|hang|unresponsive</field>
    <description>CVE-2026-96421: Wireshark process became unresponsive or crashed during USB HID dissection</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,availability,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source. The affected ranges (4.6.0–4.6.8 and 4.4.0–4.4.18) remain vulnerable as of report generation.

1) Immediate mitigations (until a patched release ships):

• Avoid opening untrusted or unsolicited .pcap/.pcapng capture files. Treat captures received via email, chat, or shared repositories as untrusted input.
• Where USB HID analysis is not operationally required, disable the USB HID dissector (Wireshark → Analyze → Enabled Protocols → uncheck "USB HID") to remove the attack surface.
• Apply process-level resource limits to Wireshark/tshark/dumpcap (CPU time, memory ceilings, watchdog timeouts) so a loop or leak is contained and the process is terminated rather than exhausting host memory.
• Isolate capture-analysis workstations in a dedicated, resource-limited environment; avoid performing untrusted-capture analysis on production analyst endpoints.
• Validate capture-file provenance and scan incoming captures with the YARA rule above before opening.

2) Patch / upgrade steps:

• Monitor the Wireshark security advisories page and the NVD entry for CVE-2026-96421 for the release of a fixed version.
• When a patched release is published, upgrade all affected installations (4.4.x and 4.6.x branches) to the fixed build. Verify the installed version via Help → About Wireshark.
• Because no patch exists at present, do not rely on upgrade alone; maintain the mitigations above until a fix is confirmed.

3) Long-term hardening:

• Establish a policy that all capture files from external or untrusted sources are opened only inside a sandboxed or containerized analysis environment with hard resource limits.
• Enable automatic update checks for Wireshark so future security releases are applied promptly.
• Restrict and audit which endpoints are permitted to run packet-capture tools (least-privilege tooling), reducing the population exposed to capture-file-based DoS.
• Add detection coverage (Sigma/YARA/Suricata/EQL/SPL rules above) to alert on anomalous USB HID capture processing and process hangs.
• Track CWE-1325 patterns in internal tooling: enforce bounded iteration and validated allocation sizes in any in-house protocol parsers.

References

• NVD — CVE-2026-96421: https://nvd.nist.gov/vuln/detail/CVE-2026-96421
• Wireshark Security Advisories: https://www.wireshark.org/security/
• MITRE CWE-1325 — Improperly Controlled Sequential Memory Allocation: https://cwe.mitre.org/data/definitions/1325.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96421 not listed as of report generation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template is known. No threat-actor campaign or in-the-wild exploitation has been attributed to CVE-2026-96421. EPSS has not been scored by FIRST.org. CISA KEV status: NO.