Loading vulnerability…
Heap buffer overflow in Wireshark CSN.1 dissector
CVE-2026-95393 is a heap-based buffer overflow in Wireshark's CSN.1 protocol dissector affecting versions 4.4.0–4.4.18 and 4.6.0–4.6.8. The CSN_RECURSIVE_ARRAY case in csnStreamDissector writes attacker-controlled decoded elements into fixed-size destination arrays without checking their capacity. Its packet-bit availability check occurs after the write and does not enforce destination bounds. A crafted GSMTAP/RLC-MAC Packet Measurement Order can trigger sequential heap corruption during live traffic dissection or capture-file processing, causing Wireshark to crash. Code execution has not been demonstrated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the affected Wireshark process and interrupt packet analysis. The vulnerability permits an attacker-controlled sequential heap overwrite with controllable element count and write length. Demonstrated array sites restrict byte values to 0–7 or 0–31. Production GUI crashes were reproduced in Wireshark 4.6.7 and 4.6.8, and AddressSanitizer detected a heap-buffer-overflow in a 4.7.3 development build. Arbitrary code execution claims in multi-vulnerability advisories are not established specifically for this vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, limit processing of untrusted packet captures and untrusted network traffic with affected Wireshark installations. Apply network and endpoint access controls to reduce exposure to attacker-controlled input, including GSMTAP traffic reaching the dissection path. These measures do not replace the bounds-checking fix.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to 4.4.19 or later, or Wireshark 4.6.x to 4.6.9 or later. On Debian 13 (trixie), upgrade the affected Wireshark packages to 4.4.19-0+deb13u1 or later. The merged fix adds recursive-array length checking; the corrective approach supplies array-length metadata and checks element count against destination capacity before each write.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.