Loading vulnerability…
Heap-based buffer overflow in Wireshark SPDY reassembly
CVE-2026-95387 is a heap-based buffer overflow in Wireshark's SPDY protocol dissector affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The spdy_assemble_data_frames() function accumulates cached DATA-frame payload lengths in a uint32_t variable without checking for integer overflow. A cumulative length exceeding the 32-bit range wraps to a small value used for allocation. When a DATA frame carrying the FIN flag triggers reassembly, memcpy() copies the cached fragments into the undersized allocation, causing heap corruption and an application crash. Exploitation through a crafted packet capture has demonstrated denial of service; arbitrary code execution has not been demonstrated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crashes the Wireshark process, interrupting packet inspection or traffic-analysis workflows. The demonstrated attack also retains approximately 4 GB of fragment data before triggering the overflow, imposing substantial memory consumption. Heap corruption is confirmed, but arbitrary code execution and confidentiality or integrity compromise have not been demonstrated. Default Linux builds since Wireshark 4.6.0 use FORTIFY_SOURCE checks that a maintainer identified as preventing code execution through this overflow while still allowing a crash.
If you can’t patch tonight, do this now.
Until patched, disable SPDY dissection where it is unnecessary and avoid processing untrusted captures or attacker-controlled SPDY traffic with affected installations. For the documented proof of concept, retain both default TCP preferences: sequence-number analysis enabled and out-of-order reassembly disabled. These settings prevent the documented reproduction but are not established as a comprehensive workaround. Process untrusted captures in resource-constrained, isolated environments to limit operational disruption.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to 4.4.19 or later, or 4.6.x to 4.6.9 or later. Distribution packages may include backported fixes: Debian 13 provides 4.4.19-0+deb13u1 under DSA-6541-1; RHEL 10 provides 4.4.2-10.el10_2.8 under RHSA-2026:84721; and RHEL 9 provides 3.4.10-9.el9_8.5 under RHSA-2026:83546. Install the applicable vendor update or a superseding release. The implementation fix uses wider length accumulation and rejects reassembly totals exceeding UINT32_MAX before allocating memory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.