Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-95388: Wireshark may crash, causing service interruption

CVE-2026-95388 · published 1 month ago

Summary

Certain versions of Wireshark (4.4.0 through 4.4.18 and 4.6.0 through 4.6.8) can be made to stop working by sending specially crafted network data. This can halt network monitoring and analysis until the program is restarted. Upgrade to a newer version or apply the vendor's patch to prevent the crash.

What to do

Update debian wireshark to version 4.4.19-0+deb13u1.
Update wireshark foundation wireshark to version 4.6.9 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	wireshark	All versions
Debian:13	debian	wireshark	< 4.4.19-0+deb13u1 Fix: upgrade to 4.4.19-0+deb13u1
Debian:14	debian	wireshark	All versions
–	wireshark foundation	wireshark	< 4.6.9
Ubuntu:Pro:14.04:LTS	canonical	wireshark	All versions

Original advisory text

Heap-based Buffer Overflow in Wireshark

Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

References

https://security-tracker.debian.org/tracker/CVE-2026-95388 Vendor Advisory
https://gitlab.com/wireshark/wireshark/-/work_items/21545 URL
https://www.wireshark.org/security/wnpa-sec-2026-101.html URL
https://ubuntu.com/security/CVE-2026-95388 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-95388 Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2026-101 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95388... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-95388 Vendor Advisory
https://gitlab.com/wireshark/wireshark Product
https://gitlab.com/wireshark/wireshark/-/issues/21545 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published29 Sep 2026

Updated26 Oct 2026

First seen29 Sep 2026

Sources

DEBIAN-CVE-2026-95388 · OSV

CVE-2026-95388 · NVD

CVE-2026-95388 · MITRE

UBUNTU-CVE-2026-95388 · OSV

CVE-2026-95388 · OSV

Track software like this

Free during beta