Loading vulnerability…
CPU denial of service in Wireshark NetMon capture-file parser
CVE-2026-95394 is an excessive-iteration vulnerability in Wireshark's Microsoft Network Monitor 2.x capture-file reader, specifically netmon_process_record(). An attacker-controlled 64-bit timestamp delta can produce a negative nanosecond value that the parser normalizes through repeated one-second adjustments. A crafted, valid capture can trigger approximately 9.22 billion loop iterations per record, consuming CPU resources and preventing useful capture analysis. The identified affected release ranges are 4.4.0–4.4.18 and 4.6.0–4.6.8; vulnerable code was also verified in older and development builds. Microsoft Network Monitor is the capture format being parsed, rather than the affected application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a crafted capture can monopolize one CPU core and render Wireshark or TShark unavailable for useful capture analysis. Capture-ingestion services using the same reader may also be affected. The demonstrated impact is availability loss; memory corruption, arbitrary code execution, confidentiality loss, integrity loss, and packet-data modification were not established for this vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict opening or processing untrusted packet captures with affected Wireshark or TShark installations, including automated capture-ingestion workflows. Apply appropriate endpoint and access controls to limit exposure to attacker-supplied captures.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to 4.4.19 or later, or Wireshark 4.6.x to 4.6.9 or later. On Debian 13 (trixie), upgrade the Wireshark packages to 4.4.19-0+deb13u1 or later. The merged parser fixes replace the slow normalization behavior; the technical recommendation is constant-time quotient-and-remainder normalization with explicit handling of negative remainders and unsafe values.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.