PEAK CAN TRC File Parser Denial of Service

Executive Summary

CVE-2026-95390 is a vulnerability in Wireshark's PEAK CAN TRC file parser versions 4.6.0 to 4.6.8. It causes the application to crash when processing a maliciously crafted packet trace file due to improper handling of malformed TRC files. The issue stems from a NULL pointer dereference in the PEAK TRC v1 error-frame parser, which fails to validate token count before accessing data elements.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Wireshark versions 4.6.0 to 4.6.8 are installed. Run `wireshark -v` or `tshark -v` to verify the version. Attempt to open a malformed TRC file with `tshark -r <file>` to see if it crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial-of-service conditions if a victim opens a specially designed TRC file. The application may crash with a segmentation fault, causing loss of functionality and potential disruption to network analysis tasks. Users are advised to upgrade to Wireshark version 4.6.9 or later to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes denial of service through application crashes when processing malformed TRC files. While it does not directly expose or leak data, it could disrupt systems handling sensitive information, potentially impacting compliance with availability requirements in GDPR or HIPAA. However, no evidence suggests data breaches or unauthorized access from this issue.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or later immediately. Avoid opening untrusted TRC files until patched. Monitor for crashes when processing TRC files as a potential indicator of exploitation.

Useful 0 Not Useful 0