Memory Leak in IEEE C37.118 Synchrophasor Protocol

Executive Summary

CVE-2026-95395 is a memory leak vulnerability in Wireshark's IEEE C37.118 Synchrophasor protocol dissector. It occurs when parsing CFG3 configuration frames, where the dissector reads the number of phasors field without validating its upper limit. This leads to excessive memory allocation (17.8 MB per frame) that is only freed when the capture file is closed, causing memory exhaustion if multiple frames are processed.

Useful 0 Not Useful 0

Detection Guidance

Monitor Wireshark processes for excessive memory usage when processing IEEE C37.118 Synchrophasor protocol traffic. Check for crashes or OOM (Out of Memory) kills in Wireshark logs. Use network monitoring tools to detect unusual traffic patterns on port 4713.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to consume excessive CPU and memory resources, potentially leading to system slowdowns or crashes. An attacker could exploit it by sending a malformed packet to port 4713 or tricking a user into opening a malicious packet trace file, resulting in denial of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by exhausting system memory, which could lead to service disruptions. While it does not directly expose or leak sensitive data, prolonged denial of service could impact systems handling regulated data under GDPR or HIPAA by preventing access to critical services. However, the vulnerability itself does not directly violate compliance requirements unless it results in unauthorized data access or prolonged unavailability of systems processing regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or later, or 4.4.19 or later. Avoid opening untrusted packet trace files. Block or monitor traffic to port 4713 if not required. Restrict access to Wireshark installations to trusted users only.

Useful 0 Not Useful 0