Loading vulnerability…
Wireshark Toshiba File Parser Buffer Over-read Denial of Service
CVE-2026-96420 is a buffer over-read vulnerability in Wireshark's Toshiba file parser affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Processing a specially crafted Toshiba-format capture file can crash the parser and cause denial of service. The vulnerability is rated Medium with a CVSS v3 score of 4.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the affected Wireshark process, interrupting capture-file analysis and causing denial of service. The CVSS v3 assessment assigns high availability impact and no confidentiality or integrity impact. Arbitrary code execution is not established for this specific vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, avoid opening or processing untrusted capture files with affected Wireshark installations, particularly Toshiba-format captures. Restrict access to affected installations using appropriate endpoint and network access controls.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to version 4.4.19 or later, or Wireshark 4.6.x to version 4.6.9 or later. On Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or later through the distribution's security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.