Loading vulnerability…
Frame protocol metadissector denial of service in Wireshark
CVE-2026-96422 is a crash vulnerability in the Wireshark frame protocol metadissector affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation causes Wireshark to crash, resulting in denial of service. The precise triggering input and underlying implementation defect are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate Wireshark and interrupt packet analysis. Arbitrary code execution is mentioned for the broader group of Wireshark vulnerabilities covered by the advisories, but is not specifically established for CVE-2026-96422.
If you can’t patch tonight, do this now.
Until updates can be deployed, limit use of affected Wireshark installations to process untrusted packet captures or network traffic, and apply appropriate network and endpoint access controls. These precautions reduce exposure but do not fix the metadissector defect.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to version 4.4.19 or later, or Wireshark 4.6.x to version 4.6.9 or later. On Debian 13 (trixie), upgrade the Wireshark packages to version 4.4.19-0+deb13u1 or later. Although one plugin labels this vulnerability unpatched, the supplied advisories identify fixed releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.