Loading vulnerability…
Heap-based buffer overflow in Wireshark SCTP fragment reassembly
CVE-2026-95389 affects the SCTP protocol dissector in Wireshark 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. The fragment_reassembly() function accumulates SCTP fragment payload lengths in an unchecked 32-bit unsigned integer. A cumulative length exceeding the representable range wraps, causing wmem_alloc() to allocate an undersized heap buffer. Subsequent memcpy() operations copy the full fragment payload into that buffer, producing a heap-based buffer overflow. Crafted packet captures can deterministically crash Wireshark or TShark; arbitrary code execution is a potential consequence but has not been demonstrated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes heap memory corruption and application termination, interrupting packet analysis or automated capture-processing workflows. A deterministic crash was reproduced with a crafted capture containing approximately 4.3 GB of SCTP fragment payload. Arbitrary code execution with the privileges of the analyzing process is considered possible, but demonstrated exploitation establishes denial of service rather than code execution.
If you can’t patch tonight, do this now.
Until patched, avoid processing untrusted packet captures and restrict exposure to untrusted network traffic. Where operationally feasible, disable SCTP dissection or fragment reassembly to avoid the vulnerable processing path. Defense-in-depth measures include limits on SCTP fragment counts, per-message reassembly size, and aggregate fragment-cache memory; these do not replace the security update.
Patch, then assume compromise.
Upgrade Wireshark to 4.4.19 or later in the 4.4 branch, or 4.6.9 or later in the 4.6 branch. Distribution-provided backports include Debian 13 version 4.4.19-0+deb13u1 under DSA-6541-1 and RHEL 10 version-release 4.4.2-10.el10_2.8 under RHSA-2026:84721. Update affected Wireshark libraries and command-line packages as applicable. Custom builds should incorporate the merged SCTP reassembly fixes that prevent cumulative-length overflow and reject oversized reassembly attempts.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.