Loading vulnerability…
Denial of Service in Wireshark ZigBee ZCL Dissector
CVE-2026-95391 is a crash vulnerability in Wireshark's ZigBee ZCL protocol dissector affecting versions 4.6.0 through 4.6.8. Processing crafted ZigBee ZCL network packets or manipulated packet-capture files can cause the dissector, and consequently Wireshark, to crash.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes a denial of service by crashing the affected Wireshark instance. The available vulnerability-specific information does not establish confidentiality, integrity, privilege-escalation, or code-execution impact for this flaw.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict use of affected Wireshark installations for opening or processing untrusted packet captures and network traffic. Apply appropriate network and endpoint access controls.
Patch, then assume compromise.
Upgrade Wireshark 4.6.x to version 4.6.9 or later. Wireshark 4.4.x installations should be upgraded to version 4.4.19 or later as part of the associated security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.