CVE-2026-96422

Executive Summary

CVE-2026-96422 is a denial-of-service (DoS) vulnerability in the Frame protocol metadissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. A reachable assertion (CWE-617) can be triggered when a crafted packet capture is parsed, causing the application to crash. The primary impact is availability loss on systems where an analyst opens or processes a malicious capture file.

Technical Analysis

The vulnerability resides in the dissector responsible for the Frame protocol within Wireshark. The NVD description states plainly: "Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service." This maps to CWE-617 (Reachable Assertion), a class of defect in which an assert() or equivalent internal invariant check fails and aborts the process when malformed input is processed. The metadissector layer in Wireshark handles framing metadata that wraps captured packets; because it operates early in the dissection pipeline, failures at this layer terminate the entire dissection process rather than degrading gracefully.

The attack surface is the packet parsing engine: any workflow that ingests untrusted packet data — opening a .pcap/.pcapng file, capturing from an interface, or feeding data into the tshark command-line dissector or the editcap/capinfos utilities — can reach the vulnerable code. No remote code execution primitive is implied by the data provided; the defect's effect is limited to a crash (process abort). The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms: local attack vector, low complexity, no privileges required, user interaction required, scope unchanged, and high availability impact with no confidentiality or integrity impact.

Exact code paths, function names, and the specific assertion that fails are not disclosed in the provided intelligence. No CVE description fragment identifies a named function, so no implementation-level naming is asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred from the vulnerability class (CWE-617) and requires that some reachable assertion within the Frame protocol metadissector is evaluable via crafted input.

1. Reconnaissance / target identification: An adversary identifies a host or workflow that processes untrusted packet captures — a SOC analyst workstation, a malware-analysis sandbox that auto-parses PCAPs, a network-forensics VM, or an automated pipeline invoking tshark/editcap on submitted captures. These environments are commonly discoverable via exposed file-ingestion portals or shared analysis queues.

2. Triggering the flaw: The adversary crafts or mutates a packet capture containing Frame protocol data designed to drive the metadissector into a state where its reachable assertion fails. Because the class of bug is an assert-based abort, the trigger is malformed or unexpected field content rather than memory corruption. The exact byte structure is not publicly documented.

3. Delivery / user interaction: Consistent with the AV:L/UI:R vector, the capture must be delivered to and opened by the victim — for example, a PCAP attached to a phishing email, hosted on a shared drive, or submitted to an analysis portal where a defender opens it.

4. Post-exploitation impact: The dissector aborts and the Wireshark process (or tshark invocation) terminates. In automated pipelines this can halt capture-processing jobs; on an analyst endpoint it interrupts an active investigation. There is no evidence of code execution, lateral movement, or data exfiltration from this defect alone.

Impact Assessment

The business impact is confined to availability of the affected parsing application and dependent analysis workflows. CVSS subscores: Confidentiality (C:N) — none; Integrity (I:N) — none; Availability (A:H) — high; Attack Vector (AV:L) — local; Attack Complexity (AC:L) — low; Privileges Required (PR:N) — none; User Interaction (UI:R) — required; Scope (S:U) — unchanged; base score 5.5 (Medium).

Blast radius depends on how Wireshark or tshark is deployed. On an individual analyst workstation the effect is a single interrupted session — low consequence and quickly recoverable. The more significant risk is in automated or shared environments: a centralized capture-ingestion service, a malware sandbox that parses PCAPs, or a detection pipeline that feeds tshark — where a single crafted capture can repeatedly crash the processing component. There is no data-loss, tampering, or credential-exposure impact per the CVSS vector. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV, indicating no confirmed exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: Wireshark Frame Dissector Crash Attempt (CVE-2026-96422)
id: 9f1c7b2e-4a6d-4e21-8b3a-7c5e0d2f1a44
status: experimental
description: Detects abnormal termination of Wireshark or tshark processes potentially triggered by a crafted capture exploiting the Frame protocol metadissector assertion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96422
author: valtersit.com
logsource:
  category: process_creation
  product: windows
  definition: Requires process termination / crash telemetry
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\editcap.exe'
  selection_flags:
    ExitCode:
      - 0xC0000409
      - 0xC0000005
      - 0x80000003
  condition: selection_img and selection_flags
falsepositives:
  - Legitimate crashes for unrelated reasons
  - Debug/development builds
level: low
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_96422_Wireshark_Frame_Crash_Capture
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of capture files associated with the Frame protocol metadissector crash (CVE-2026-96422). Detection is heuristic; no public PoC defines an exact byte signature."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96422"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pcap_magic_le = { d4 c3 b2 a1 }
        $pcap_magic_be = { a1 b2 c3 d4 }
        $pcapng_magic  = { 0a 0d 0d 0a }

    condition:
        ($pcap_magic_le at 0 or $pcap_magic_be at 0 or $pcapng_magic at 0)
        and filesize < 50MB
}

Suricata IDS Rule

alert tcp any any -> any any ( \
  msg:"CVE-2026-96422 Wireshark Frame Protocol Metadissector DoS - Suspicious Capture Transfer"; \
  flow:established,to_client; \
  fileext:"pcap"; \
  filestore; \
  classtype:attempted-dos; \
  reference:cve,2026-96422; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96422; \
  sid:202696422; \
  rev:1; )

Elastic Detection

process where event.type == "end" and
  process.name : ("wireshark.exe", "tshark.exe", "editcap.exe") and
  process.exit_code in (3221226505, 3221225477, 2147483651)

Splunk SPL Query

index=endpoint (Image IN ("*\\wireshark.exe","*\\tshark.exe","*\\editcap.exe") OR process_name IN ("wireshark","tshark","editcap"))
| where exit_code IN ("3221226505","3221225477","2147483651","-1073740791","-1073741819")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(exit_code) as exit_codes by host, user, process_name, process
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-96422,">
  <rule id="2026964" level="6">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">wireshark\.exe|tshark\.exe|editcap\.exe</field>
    <field name="win.eventdata.exitCode">3221226505|3221225477|2147483651</field>
    <description>CVE-2026-96422: Possible Wireshark Frame dissector crash (abnormal termination).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch, vendor advisory, workaround, or affected-package mapping was reported by any tracked source for this CVE. The guidance below is therefore class-based and must be validated against upstream Wireshark release notes before being treated as authoritative.

1. Immediate mitigations:

   • Treat all untrusted packet captures as hostile input. Do not auto-open PCAPs from email attachments, shared drives, tickets, or external submissions on analyst endpoints or in production parsing pipelines.
   • In automated pipelines invoking tshark, editcap, or capinfos, isolate the parser (container, sandbox, or low-privilege service account) so a crash does not affect the host or other jobs, and add process supervision/restart with alerting on abnormal exit codes.
   • Quarantine or scan captures prior to opening; prefer offline, isolated analysis VMs for untrusted traffic.
   • Apply least privilege to accounts running capture analysis to limit any secondary impact of a process abort.

2. Patch / upgrade steps:

   • No fixed version is confirmed by the data provided. Monitor the Wireshark security advisories page and release notes for the specific version that resolves the Frame protocol metadissector assertion, and upgrade Wireshark/Libwiretap to the first release where the advisory is marked fixed.
   • Because 4.6.0–4.6.8 and 4.4.0–4.4.18 are the reported vulnerable ranges, prefer the newest available maintenance release in the supported branch once a fix is published, and verify the installed version after upgrade.

3. Long-term hardening:

   • Enforce a policy of parsing untrusted captures only within disposable, network-isolated analysis environments.
   • Add crash telemetry for analysis tooling (exit codes, restart events) to SIEM so repeated aborts are visible as a pattern.
   • Track CVE feeds for Wireshark dissector defects and prioritize based on exposure of parsing infrastructure, not just base CVSS.
   • Keep a rollback/snapshot strategy for parsing hosts to recover quickly from deliberate crash attempts.

References

• National Vulnerability Database — CVE-2026-96422: https://nvd.nist.gov/vuln/detail/CVE-2026-96422
• MITRE CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
• Wireshark Security Advisories (vendor advisories and fixed-version notices): https://www.wireshark.org/security/
• FIRST.org EPSS (CVE-2026-96422 not yet scored at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, PoC, Nuclei template, or exploit-in-the-wild evidence was identified for CVE-2026-96422. No known threat actor campaign is associated with this vulnerability in the data provided.