CVE-2026-96423

Executive Summary

CVE-2026-96423 is a heap-based buffer overflow (CWE-122) in the X11 protocol dissector of Wireshark, the widely deployed open-source network protocol analyzer. The flaw affects Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, and is triggered when a crafted packet capture is parsed by the X11 dissector. Successful exploitation causes a crash and denial of service, with a CVSS v3.1 base score of 5.5 reflecting a local attack vector, low attack complexity, no privileges required, and user interaction required.

Technical Analysis

The vulnerability resides in the X11 protocol dissector, the component responsible for decoding the X Window System protocol traffic commonly captured between X11 clients and servers on Unix-like systems. According to the NVD description, the defect is classified as CWE-122 — Heap-based Buffer Overflow. This means the dissector writes data beyond the bounds of a heap-allocated buffer while parsing malformed X11 protocol data.

The attack surface is the packet parsing pipeline: Wireshark dissects captured frames either live from an interface or from a saved capture file. When the X11 dissector processes a specially crafted packet or capture, its buffer management logic fails to correctly bound the write operation, corrupting adjacent heap memory. The CVSS vector (AV:L, AC:L, PR:N, UI:R) indicates: the attacker must deliver the malicious capture to the victim's local environment (AV:L), no special conditions are required (AC:L), no authentication or privileges are needed (PR:N), but the victim must open or process the malicious capture (UI:R). The impact is confined to availability (A:H) with no confidentiality or integrity impact (C:N/I:N/A:H). Because the flaw is memory-corruption class, the crash is the reliably observable effect; whether adjacent memory corruption could be further leveraged is not established by the available data, and no specific exploitation primitives are documented in the NVD description.

The affected version ranges are explicitly delimited: 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The OSV package records describe the affected commit states as "unfixed" in the referenced snapshots, while patch confidence of 3/4 (LIKELY) is indicated by two independent sources (OSV and Debian) confirming a fix. No vendor advisory text, no workaround, and no affected-version array were provided beyond the version ranges above; consequently, the precise patched version number is inferred from the standard Wireshark patch-release cadence rather than confirmed verbatim in the supplied data.

Exploitation Scenarios

No public exploit code is confirmed in the supplied data (Exploit Code: NO), though PoC status is listed as Public and no Nuclei template exists. Because the NVD description is sparse and provides no function names, file paths, or parameter names, the attack chain is described strictly at the vulnerability-class level.

1. Reconnaissance / target identification. An adversary identifies a target environment that runs an affected Wireshark build (4.6.0–4.6.8 or 4.4.0–4.4.18) and whose users routinely process captures containing X11 traffic. Targets of interest include engineering workstations, network operations centers, and forensic analysis stations that handle untrusted or externally sourced pcaps.

2. Triggering the flaw. The attacker crafts a packet capture containing malformed X11 protocol traffic designed to reach the vulnerable parsing path in the X11 dissector. Per CWE-122, the crafted input causes a heap-based buffer overflow when the dissector writes beyond the allocated buffer during decoding.

3. Payload / execution method. Delivery is user-interaction dependent (UI:R): the malformed capture must be opened in Wireshark or otherwise fed into the dissection pipeline. The malicious capture can be distributed via email attachment, shared file storage, or a download link, and is only effective once the victim loads it.

4. Post-exploitation impact. The reliably described consequence is a crash of the Wireshark application — a denial of service (A:H). A crash mid-capture can interrupt incident response, forensic collection, and monitoring workflows. No data theft, lateral movement, or persistence is documented in the available data, and no in-the-wild exploitation is recorded (CISA KEV: NO).

Impact Assessment

CVE-2026-96423 is rated CVSS v3.1 5.5 (Medium). Subscores: AV:L (local vector), AC:L (low complexity), PR:N (no privileges required), UI:R (user interaction required), S:U (scope unchanged), and impact C:N/I:N/A:H. The sole impact is high availability loss: exploitation crashes the affected Wireshark process, causing denial of service. There is no documented confidentiality or integrity impact, and scope is unchanged, so the blast radius is limited to the Wireshark instance processing the malicious capture and any analyst workflow depending on it. EPSS is 0.00134 (2.5th percentile), indicating low predicted exploitation likelihood in the wild. The affected population is broad — any organization using Wireshark 4.4.0–4.4.18 or 4.6.0–4.6.8 for network troubleshooting, security monitoring, or digital forensics — but the practical risk is concentrated in environments that routinely open captures from untrusted or third-party sources.

Detection Guidance

Sigma Rule

title: Wireshark X11 Dissector Crash - Potential DoS Attempt
id: 8f3c2a1e-9642-4cve-4b23-9d1e0a7f5b21
status: experimental
description: Detects Wireshark process termination consistent with the X11 dissector heap overflow denial of service (CVE-2026-96423)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96423
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_flags:
    CommandLine|contains:
      - '-r '
      - '-i '
  condition: selection_img and selection_flags
  falsepositives:
    - Normal analyst use of Wireshark/tshark on benign captures
level: low
tags:
  - attack.t1203
  - cve.2026.96423

YARA Rule

rule CVE_2026_96423_X11_Dissector_Crash
{
    meta:
        description = "Detects malformed X11 protocol capture content associated with CVE-2026-96423 heap overflow DoS"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96423"
        date = "2026-01-01"
        cve = "CVE-2026-96423"

    strings:
        $pcap_magic_le = { d4 c3 b2 a1 }
        $pcap_magic_be = { a1 b2 c3 d4 }
        $pcapng_magic  = { 0a 0d 0d 0a }
        $x11_hint      = "X11" ascii
        $wireshark     = "Wireshark" ascii

    condition:
        (uint16(0) == 0xa1b2 or uint16(0) == 0xd4c3 or uint32(0) == 0x0a0d0d0a) and
        ($x11_hint or $wireshark)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-96423 Wireshark X11 Dissector Heap Overflow DoS Attempt"; flow:to_client,established; content:"X11"; nocase; content:"|00 0c|"; depth:64; classtype:attempted-dos; reference:cve,2026-96423; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96423; sid:9642301; rev:1;)

Elastic Detection

process where process.name in ("wireshark.exe", "tshark.exe", "wireshark", "tshark") and
  process.command_line contains "-r" and
  event.action == "end" and process.exit_code != 0

Splunk SPL Query

index=endpoint OR index=sysmon (Image="*\\wireshark.exe" OR Image="*\\tshark.exe" OR Image="*wireshark" OR Image="*tshark")
| where (ExitCode != 0 OR EventCode=1) AND (CommandLine="*-r *" OR CommandLine="*-i *")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, CommandLine, ExitCode
| where count >= 1

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-96423,">
  <rule id="100423" level="5">
    <decoded_as>json</decoded_as>
    <field name="process.name">wireshark|tshark|dumpcap</field>
    <field name="process.command_line">-r</field>
    <description>CVE-2026-96423: Wireshark/tshark invoked with capture file - possible X11 dissector DoS attempt (parent 59201)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
  <rule id="100424" level="8">
    <if_sid>100423</if_sid>
    <field name="process.exit_code">\!0</field>
    <description>CVE-2026-96423: Wireshark/tshark abnormal termination following capture processing - suspected X11 dissector crash</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources, OSV and Debian, confirm the fix). No vendor advisory text or explicit patched version string was supplied; the version guidance below follows the standard Wireshark patch-release cadence for the affected branches and should be verified against the vendor's release notes.

1. Immediate mitigations.

   • Avoid opening untrusted or unsolicited packet captures with affected Wireshark versions; treat externally sourced pcaps as hostile input.
   • Where capture review is unavoidable, isolate the analysis host (dedicated VM/container with no sensitive data) and restore from a clean snapshot afterward.
   • Restrict which users and workstations may process third-party captures until patched.
   • Consider filtering X11 protocol decode (e.g., disabling the X11 dissector for ad-hoc analysis) to reduce exposure, recognizing this is a compensating control and not a fix.

2. Patch / upgrade steps.

   • Upgrade to the first patched release in the maintained branches — expected to be Wireshark 4.6.9 or 4.4.19 or later, per OSV and Debian fix confirmation.
   • Verify the exact fixed version against the official Wireshark advisory before deployment.
   • Update via managed software distribution; confirm version strings on endpoints after rollout.
   • Re-test any automated capture-processing pipelines to ensure the patched build is used everywhere tshark or dumpcap runs.

3. Long-term hardening.

   • Enforce a policy that packet captures are processed only in sandboxed, disposable environments.
   • Track Wireshark releases on a routine patch cadence and remove end-of-life branches (e.g., 4.4.x once superseded).
   • Integrate SBOM/version inventory to flag running instances of affected versions.
   • Monitor for abnormal Wireshark/tshark process terminations as an early indicator of exploitation attempts.

References

• NVD — CVE-2026-96423: https://nvd.nist.gov/vuln/detail/CVE-2026-96423
• OSV — package and fix confirmation entry for the Wireshark X11 dissector crash
• Debian Security Tracker — Wireshark CVE-2026-96423 fixed-version record
• Wireshark Security Advisories — https://www.wireshark.org/security/
• CWE-122 Heap-based Buffer Overflow — https://cwe.mitre.org/data/definitions/122.html

No CISA KEV listing and no confirmed in-the-wild exploitation or threat-actor campaign were identified in the data provided for CVE-2026-96423.