TIFF Protocol Dissector Infinite Loop in Wireshark

Executive Summary

CVE-2026-96418 is an infinite loop vulnerability in Wireshark's TIFF protocol dissector affecting versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. It occurs when the dissector processes malformed TIFF files or network packets, causing Wireshark to consume excessive CPU resources indefinitely.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Wireshark processes for excessive CPU usage when processing TIFF files or network traffic. Use Wireshark's built-in tools to analyze malformed TIFF packets or files. Check for infinite loops by examining logs for repeated dissector operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial-of-service by freezing or crashing Wireshark when opening a malformed TIFF file or processing malicious network traffic. It may lead to system slowdowns, unresponsiveness, or complete resource exhaustion on affected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining data processing systems securely, and HIPAA mandates protecting health data systems from disruptions. While the flaw itself does not directly expose data, a DoS attack could lead to unauthorized access or system downtime, potentially violating availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 (or later) immediately. Avoid opening untrusted TIFF files or network traffic captures. Disable the TIFF dissector if not needed. Monitor system resources for unusual CPU spikes.

Useful 0 Not Useful 0