CVE-2026-96421

Wireshark is a tool used to inspect network traffic, often by IT staff debugging problems or investigating security incidents. This flaw is like a poisoned document: if someone opens a specially crafted capture file, the program gets stuck and eventually freezes or crashes instead of behaving normally. It doesn't let an attacker steal data or control the computer — it just breaks the tool itself.

This matters to you if your IT staff or security team uses Wireshark (versions 4.6.0–4.6.8 or 4.4.0–4.4.18) to inspect network traffic, particularly USB device traffic. It's only a risk if someone opens an untrusted or unverified capture file in a vulnerable copy of Wireshark — browsing the web or normal business operations are not affected.

No confirmed real-world attacks or public exploit code exist for this yet, and it only triggers a crash, not data theft. Even so, it requires no special privileges to trigger and is easy to exploit by simply sharing a malicious capture file, so it should be patched before someone relies on Wireshark during an incident and gets blocked.

Confirm exposure by checking installed Wireshark versions across all workstations where it's used (vulnerable: 4.6.0–4.6.8, 4.4.0–4.4.18) and whether the USB HID dissector is enabled (default build includes it). Upgrade to 4.6.9 on the 4.6.x branch or 4.4.19 on the 4.4.x branch — both are straightforward point-release upgrades with no known breaking changes. If immediate patching isn't possible, as a temporary workaround avoid opening untrusted capture files and/or disable the USB HID dissector in Analyze > Enabled Protocols. There is no CISA KEV listing and no due date requirement. Monitor the Wireshark security advisory (wnpa-sec-2026-103) and GitLab issue 21566 for any escalation or exploit-code publication, which would raise urgency.

CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a local, user-interaction-required denial-of-service with high availability impact and no confidentiality/integrity loss. Weakness is CWE-1325 (improperly controlled sequential memory allocation), manifesting as an infinite loop with unbounded memory growth in the USB HID dissector when parsing a crafted packet. Not in CISA KEV; no public exploit code; EPSS scoring places likelihood of near-term exploitation in the wild as very low with a flat trend. Press attention is rising but tied to a general vulnerability roundup, not a confirmed exploitation event — exploit maturity remains theoretical/PoC-free.