CVE-2026-96421: Improperly Controlled Sequential Memory Allocation in Wireshark
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.9
Event History
Frequently Asked Questions
What must an attacker provide to trigger the denial of service?
An attacker must cause Wireshark to process crafted USB HID protocol data. The issue requires user interaction, consistent with the UI:R vector.
Are installations using the affected release branches exposed by default?
The affected Wireshark versions are 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exposure depends on processing USB HID traffic or capture data containing USB HID protocol data.
What is the impact if exploitation succeeds?
Successful exploitation can cause an infinite loop and memory leak in the USB HID protocol dissector, resulting in denial of service. The provided vector indicates no confidentiality or integrity impact.