What happened
A vulnerability has been identified in certain versions of Wireshark, specifically versions 4.6.0 to before 4.6.9 and 4.4.0 to before 4.4.19. This flaw, CVE-2026-95389, affects the SCTP protocol dissector component of Wireshark. Exploitation of this vulnerability can lead to a crash in the dissector process, resulting in a denial of service condition. The issue is caused by a weakness in the handling of SCTP protocol data, which can be triggered remotely over a network. Successful exploitation does not require prior access or user interaction, making it particularly significant for network-exposed systems.
The vulnerability has been rated as high severity, with a CVSS base score of 8.1. It is classified under CWE-122, indicating a flaw related to heap-based buffer overflow. The impact on affected systems is substantial, as an attacker can cause system disruptions without the need for authentication or user participation. The flaw resides within the core Wireshark application, which analysts have confirmed is vulnerable when the SCTP protocol dissector processes malicious data.
At present, no specific patches or updates are available to remediate this vulnerability directly. Mitigations focus on controlling network access to the affected services, for example, through network segmentation or access controls. The flaw is reachable remotely, highlighting the importance of network-level protection measures until updates are released.
Who is affected
Organisations running vulnerable versions of Wireshark, specifically versions 4.6.0 to before 4.6.9 and 4.4.0 to before 4.4.19, are affected by this vulnerability. Affected deployments are those with SCTP protocol dissectors exposed to unauthenticated remote data sources. Any network service utilizing these Wireshark versions and processing SCTP data that could be externally accessed may be susceptible to exploitation. Systems with open or publicly accessible network interfaces that rely on these Wireshark versions for network analysis or inspection are particularly at risk.
Recommended actions
- Implement network segmentation and access controls to restrict direct access to services that process or analyse SCTP traffic, thereby reducing the attack surface.
- Monitor for the availability of security updates or patches that address the CVE-2026-95389 vulnerability and apply them promptly once available.
- Configure network firewalls and intrusion detection systems to detect and block malicious SCTP traffic that may be used to trigger the vulnerability.
- Limit exposure of experimental or development deployments where vulnerable Wireshark versions might be running in exposed environments.
Indicators of compromise
No specific indicators of compromise are currently available for this vulnerability.
