Microsoft Network Monitor File Parser Denial of Service

Executive Summary

CVE-2026-95394 is a denial-of-service vulnerability in Wireshark's Microsoft Network Monitor file parser. It involves a flaw where manipulated timestamps in a small capture file can cause an infinite loop in the netmon_process_record() function, consuming excessive CPU resources. The issue affects Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18.

Useful 0 Not Useful 0

Detection Guidance

Monitor CPU usage spikes when opening packet capture files in Wireshark or tshark. Check for infinite loops during file parsing by observing unresponsive processes. Use system monitoring tools like top or htop to detect excessive CPU consumption from Wireshark processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing your system to become unresponsive or slow down significantly when opening a maliciously crafted packet trace file. It may fully occupy a single CPU core, preventing further analysis or normal system operations until the process is terminated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service by consuming excessive CPU resources, which could disrupt system availability. For compliance standards like GDPR or HIPAA, which require data availability and security, such disruptions may lead to violations if critical systems are affected. However, the vulnerability does not directly impact data confidentiality or integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 or later immediately. Avoid opening untrusted packet capture files until patched. Disable NetMon file parser if possible or restrict access to Wireshark until updates are applied.

Useful 0 Not Useful 0