Loading vulnerability…
Wireshark Catapult DCT2000 Dissector Denial of Service
CVE-2026-96415 is a crash vulnerability in Wireshark's Catapult DCT2000 protocol dissector affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Processing malicious DCT2000 protocol traffic or capture data can crash Wireshark, resulting in denial of service. The underlying programming defect and specific vulnerable function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who can supply or induce processing of malicious DCT2000 traffic or capture data can crash the affected Wireshark process and interrupt packet analysis. Arbitrary code execution is mentioned for the broader group of Wireshark vulnerabilities, but is not specifically established for CVE-2026-96415.
If you can’t patch tonight, do this now.
Until patched, avoid opening or dissecting untrusted DCT2000 traffic or capture files. Restrict analysis of untrusted captures to isolated environments, limit use of affected installations for untrusted inputs, and apply appropriate network and endpoint access controls.
Patch, then assume compromise.
Upgrade Wireshark 4.6.x to version 4.6.9 or later, or Wireshark 4.4.x to version 4.4.19 or later. On Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.