Toshiba File Parser Crash Leads to DoS

Executive Summary

CVE-2026-96420 is a vulnerability in Wireshark's Toshiba file parser that causes a crash leading to denial of service. It affects versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. The issue occurs when processing a malformed packet trace file, specifically a short OFFSET line in the Toshiba capture file format. The parser reads into a fixed stack buffer without clearing it, causing unintended data reads that may crash Wireshark.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Wireshark when opening Toshiba capture files. Check Wireshark version with 'wireshark --version' to see if it falls within vulnerable ranges (4.6.0-4.6.8 or 4.4.0-4.4.18). Inspect network traffic for unusual Toshiba file parser activity or malformed packets.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash Wireshark by convincing a user to open a specially crafted Toshiba capture file. This results in denial of service, disrupting network analysis and monitoring activities. No known exploits exist currently, but users should upgrade to patched versions to avoid potential risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service through a crash in Wireshark's Toshiba file parser. While it does not directly expose or leak data, a crash could disrupt monitoring or logging activities, potentially impacting compliance with standards requiring continuous availability of systems handling sensitive data like GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to version 4.6.9 or 4.4.19 or later immediately. Avoid opening untrusted Toshiba capture files. If upgrading is not possible, disable the Toshiba file parser in Wireshark's preferences or avoid using affected versions.

Useful 0 Not Useful 0