Loading vulnerability…
X11 protocol dissector denial of service in Wireshark
CVE-2026-96423 is a crash vulnerability in the Wireshark X11 protocol dissector affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a dissector crash that results in denial of service. The precise triggering input and underlying implementation defect are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash the X11 protocol dissector and disrupt affected Wireshark processing, causing denial of service. Broader advisories covering multiple Wireshark vulnerabilities also describe arbitrary code execution, but that outcome is not specifically established for CVE-2026-96423.
If you can’t patch tonight, do this now.
Until updates can be deployed, limit affected Wireshark installations' processing of untrusted packet captures and network traffic, and apply appropriate network and endpoint access controls. These measures reduce exposure but do not fix the dissector defect.
Patch, then assume compromise.
Upgrade Wireshark 4.4.x to version 4.4.19 or later, or Wireshark 4.6.x to version 4.6.9 or later. For Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.