Sharkd Utility Denial of Service Vulnerability

Executive Summary

CVE-2026-95388 is a vulnerability in Sharkd, the backend component of Wireshark, that causes a crash due to an integer overflow during RTP resampling. An attacker can exploit this by providing a maliciously crafted SIP/SDP and RTP capture file with specific clock rates, leading to an undersized buffer allocation and out-of-bounds write in the Speex resampler. This results in a deterministic crash of the Sharkd worker process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Wireshark versions. Run 'wireshark -v' or 'sharkd -v' to identify installed versions. If running 4.6.0 to 4.6.8 or 4.4.0 to 4.4.18, the system is vulnerable. Monitor Sharkd processes for crashes during RTP operations, especially when handling SIP/SDP and RTP capture files.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service by crashing the Sharkd utility, which handles audio export operations in Wireshark. This disrupts legitimate Sharkd operations like loading capture files, analyzing RTP streams, or downloading RTP data. The impact is limited to worker termination and does not allow code execution or data theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by crashing the Sharkd utility, which could disrupt network analysis operations. For GDPR, this may impact data processing activities requiring availability, potentially violating Article 32. For HIPAA, it could affect systems handling protected health information by causing service disruptions, though no data exposure is indicated.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to versions 4.6.9 or later, or 4.4.19 or later. Avoid processing untrusted capture files with Sharkd, particularly those containing SIP/SDP and RTP streams. Implement input validation for sample rates in RTP operations to prevent integer overflows.

Useful 0 Not Useful 0