Loading vulnerability…
TIFF dissector infinite-loop denial of service in Wireshark
CVE-2026-96418 is an infinite-loop vulnerability in the Wireshark TIFF protocol dissector affecting versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. Processing maliciously crafted TIFF protocol traffic can cause the dissector to enter an infinite loop, resulting in denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause the affected Wireshark dissector to loop indefinitely, disrupting packet processing and application availability. Arbitrary code execution is mentioned for the broader group of Wireshark vulnerabilities, but is not established for this specific CVE.
If you can’t patch tonight, do this now.
Until updates can be deployed, limit affected Wireshark installations from opening or processing untrusted packet captures or network traffic, and apply appropriate network and endpoint access controls.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to version 4.4.19 or later, or Wireshark 4.6.x to version 4.6.9 or later. On Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.