CVE-2026-95395: Missing Release of Memory after Effective Lifetime in Wireshark
Published Sep 29, 2026
·Updated
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected Software
1 affected component
Wireshark Wireshark>=4.6.0<=4.6.8, >=4.4.0<=4.4.18
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wiresharkto a version that resolves this vulnerability.Fixed in 4.6.9
Event History
Sep 29, 2026
CVE Published
via MITRE·09:33 AM
Data Sourced
via MITRE·09:33 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are affected when handling IEEE C37.118 Synchrophasor protocol traffic.
2
What does an attacker need to do to trigger the issue?
The attack vector is local and requires user interaction. Exploitation involves causing an affected Wireshark instance to process IEEE C37.118 Synchrophasor protocol data, resulting in a memory leak that can cause denial of service.