Loading vulnerability…
Denial of service in Wireshark USB HID dissector
CVE-2026-96421 is an infinite-loop and memory-leak vulnerability in Wireshark's USB HID protocol dissector. It affects versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Processing crafted USB HID traffic or manipulated capture data can trigger the flaw, causing denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause Wireshark to enter an infinite processing loop and leak memory, rendering the application unresponsive or causing it to crash. Arbitrary code execution is not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, limit processing of untrusted packet captures and network traffic with affected Wireshark installations. Apply appropriate network and endpoint access controls to reduce exposure to attacker-controlled input.
Patch, then assume compromise.
Upgrade Wireshark 4.6.x to version 4.6.9 or later, or Wireshark 4.4.x to version 4.4.19 or later. On Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.