Loading vulnerability…
Memory-exhaustion denial of service in Wireshark Synchrophasor dissector
CVE-2026-95395 is a memory-leak vulnerability in Wireshark's IEEE C37.118 Synchrophasor protocol dissector, affecting versions 4.4.0–4.4.18 and 4.6.0–4.6.8. The config_3_frame_fast() function accepts the CFG3 num_ph phasor-count field without an upper-bound check and allocates a transient array using wmem_file_scope(). A crafted frame can trigger approximately 17.8 MB of allocation, retained until the capture file is closed, including when parsing raises an exception. Repeated processing can exhaust memory and terminate Wireshark or TShark.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Crafted Synchrophasor CFG3 frames can cause disproportionate, cumulative memory consumption and denial of service. A single 78-byte UDP packet can trigger approximately 17.8 MB of allocation; a capture containing 1,000 crafted frames can consume approximately 17 GB. Exhaustion can terminate Wireshark or TShark through an out-of-memory kill or a g_malloc abort.
If you can’t patch tonight, do this now.
Until updates can be deployed, limit affected installations' processing of untrusted packet captures and network traffic, and apply appropriate network and endpoint access controls.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to 4.4.19 or later, or Wireshark 4.6.x to 4.6.9 or later. On Debian 13 (trixie), upgrade the Wireshark packages to 4.4.19-0+deb13u1 or later. The merged fix addresses file-scope allocation of the transient array; implementation recommendations include bounding num_ph before allocation and using packet-scoped allocation for temporary data.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.