SPDY Protocol Dissector Crash in Wireshark

Executive Summary

CVE-2026-95387 is a high-severity integer overflow vulnerability in Wireshark's SPDY dissector that causes a heap buffer overflow. It occurs when a uint32_t variable accumulates fragment lengths without overflow protection in the spdy_assemble_data_frames() function. When the total exceeds 2^32 bytes, the value wraps to a small number, leading to an undersized buffer allocation. Subsequent memory operations corrupt the heap and crash Wireshark.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Wireshark when processing SPDY traffic. Use Wireshark's built-in dissector to analyze network captures for malformed SPDY DATA frames. Check for crashes or heap corruption when opening pcap files with large SPDY payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be triggered by opening a malicious packet trace file or receiving a malformed SPDY packet, causing Wireshark to crash. While no known exploits exist, the overflow could potentially allow arbitrary code execution. Attackers could craft a pcap file (~4 GB) with specific SPDY DATA frames to exploit this issue, leading to denial of service or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing Wireshark, which could disrupt network monitoring and analysis. For GDPR, it may impact data integrity and availability if Wireshark is used for logging or forensic analysis. HIPAA compliance could be affected if the tool is used in healthcare environments for packet inspection, as crashes may lead to incomplete or corrupted data handling.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 or later. Avoid opening untrusted pcap files or processing suspicious network traffic. Disable SPDY dissector if not needed. Monitor for crashes or unusual behavior in Wireshark.

Useful 0 Not Useful 0