IEEE 802.11 Protocol Dissector DoS in Wireshark

Executive Summary

CVE-2026-96416 is a vulnerability in Wireshark's IEEE 802.11 protocol dissector that causes a crash due to a length desynchronization between two Fast BSS Transition (FT) elements in 802.11 management frames. When Wireshark's decryption feature is enabled, a crafted frame with two FT elements can trigger a negative length value, leading to an out-of-bounds read in libgcrypt and crashing the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Wireshark or tshark when analyzing WPA traffic with decryption enabled. Look for malformed IEEE 802.11 management frames with two Fast BSS Transition elements. Use Wireshark versions 4.6.0 to 4.6.8 or 4.4.0 to 4.4.18 to check for crashes during packet capture or trace file analysis.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark or tshark to crash, resulting in a denial of service. It may be exploited by injecting a malformed packet into the network or tricking a user into opening a malicious packet trace file. Users analyzing WPA traffic with decryption enabled are particularly affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial of service by crashing Wireshark, which could disrupt network monitoring and analysis activities. For compliance with standards like GDPR or HIPAA, continuous monitoring and logging are often required. A crash could lead to gaps in logging or monitoring, potentially violating record-keeping or audit requirements if critical network traffic is not captured or analyzed.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or later, or 4.4.19 or later. Avoid opening untrusted packet trace files. Disable Wireshark's decryption feature if not required. Monitor network traffic for suspicious IEEE 802.11 management frames with two FT elements.

Useful 0 Not Useful 0