X11 Protocol Dissector Crash in Wireshark

Executive Summary

CVE-2026-96423 is an out-of-bounds heap read flaw in Wireshark's X11 protocol dissector. It occurs when the dissector caches keysym arrays with varying widths but only tracks a single width value. If an X_ChangeKeyboardMapping request reduces the array width while the scalar width remains larger, subsequent KeyPress events cause an out-of-bounds read in the keycode2keysymString() function. This can lead to crashes, AddressSanitizer errors, or information disclosure by exposing heap data as decoded keysyms.

Useful 0 Not Useful 0

Detection Guidance

Monitor Wireshark for crashes or AddressSanitizer heap-buffer-overflow errors when processing X11 protocol packets. Check for malformed packets on TCP ports 6000–6063. Use Wireshark's built-in dissector validation to detect inconsistencies in keysym arrays.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to crash Wireshark by sending a malformed packet or tricking a user into opening a malicious packet trace file. Since the X11 dissector is enabled by default on TCP ports 6000–6063, no additional configuration is required for exploitation. While no known exploits exist in the wild, successful exploitation could result in denial of service or potential information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service or crashes in Wireshark due to an out-of-bounds heap read in the X11 dissector. It does not directly impact data confidentiality or integrity but could disrupt network analysis workflows. Compliance impact is likely minimal unless the affected systems are part of regulated environments where service availability is critical.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wireshark to versions 4.6.9 or 4.4.19 and later. Disable the X11 dissector if not needed by editing preferences or disabling TCP ports 6000–6063. Avoid opening untrusted capture files.

Useful 0 Not Useful 0