CVE-2026-95389

Wireshark is like a diagnostic tool mechanics use to read a car's internal computer logs — IT staff use it to see exactly what's happening on a network when something goes wrong. This bug is like a faulty gauge on that diagnostic tool: feeding it a specially crafted reading can make the tool itself malfunction, crash, or behave unpredictably, right when you need it to work.

This matters to you if your IT staff, security team, or network administrators use Wireshark to inspect network traffic or analyze capture files. It is not a tool typically run by everyday employees or customers, so the direct business exposure is usually limited to whoever handles your network diagnostics — but if that person opens a malicious capture file or analyzes traffic from an untrusted source, their machine is at risk.

This is a high-severity flaw that can be triggered remotely without any login or user action beyond opening a crafted capture or traffic stream, so treat it as urgent even though there is no confirmed active exploitation yet. There's no public exploit code circulating and it hasn't been flagged by government cybersecurity agencies as actively used, but the ease of triggering it and the severity of the outcome mean you should not wait to patch.

Confirm exposure by checking installed Wireshark versions across all workstations and servers where it's used, focusing on the 4.4.0–4.4.18 and 4.6.0–4.6.8 ranges (the vulnerable SCTP dissector code path). Upgrade to 4.4.19 on the 4.4.x branch or 4.6.9 on the 4.6.x branch — there is no breaking-change concern noted for either upgrade path. If immediate patching isn't possible, mitigate by avoiding analysis of untrusted capture files or live SCTP traffic from untrusted sources, and consider disabling the SCTP dissector in Wireshark's protocol preferences as a temporary workaround. No CISA KEV listing exists, so there's no federal remediation deadline. Monitor the Wireshark security advisory (wnpa-sec-2026-93) and the associated GitLab issue for any updates on exploitation status or further fixes.

CVSS 3.1 score 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a remotely triggerable heap-based buffer overflow (CWE-122) in the SCTP dissector, with high confidentiality, integrity, and availability impact but high attack complexity. EPSS places predicted exploitation likelihood in the lower range with a flat trend, and there is no KEV listing or public exploit code, indicating exploitation is theoretical rather than observed at this time. Press attention has been sustained but stems from a general vulnerability roundup rather than confirmed in-the-wild activity; the ShinyHunters reference is contextual press coverage, not evidence this actor is exploiting this specific CVE.