SCTP Protocol Dissector Crash in Wireshark

Executive Summary

CVE-2026-95389 is a critical vulnerability in Wireshark affecting SCTP protocol dissection. It involves an integer overflow in the fragment reassembly function that leads to a heap buffer overflow. The flaw occurs when fragment payload lengths are accumulated without overflow protection, causing a wrap-around to a small value. This results in an undersized buffer allocation and subsequent memory corruption when large amounts of data are copied.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Wireshark when processing SCTP traffic or opening pcap files. Use Wireshark's built-in tools to analyze SCTP fragments for unusually large payloads or excessive fragment counts. Check for heap corruption errors in logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to crash or potentially allow arbitrary code execution with the privileges of the user running Wireshark. An attacker could exploit it by tricking a victim into opening a crafted pcap file or sending malicious SCTP network traffic containing many fragments. The attack requires a large file or traffic volume, making it more likely to succeed in offline scenarios.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service or arbitrary code execution through crafted SCTP traffic or pcap files. If exploited, it may disrupt Wireshark's availability, potentially affecting monitoring and logging required for regulatory compliance. However, no direct evidence links this specific flaw to data breaches or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 and later. Avoid opening untrusted pcap files or processing suspicious network traffic. Implement network monitoring to block malformed SCTP packets if possible.

Useful 0 Not Useful 0