{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96417", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-09-23T05:41:30.662Z", "datePublished": "2026-09-29T09:30:58.021Z", "dateUpdated": "2026-09-29T15:41:14.438Z"}, "containers": {"cna": {"title": "Heap-based Buffer Overflow in Wireshark", "descriptions": [{"lang": "en", "value": "RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.9", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "cweId": "CWE-122", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-104.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21574"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.9 or above"}], "credits": [{"lang": "en", "value": "Trend Micro's Zero Day Initiative", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-09-29T09:30:58.021Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T15:38:16.540898Z", "id": "CVE-2026-96417", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T15:41:14.438Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.9", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.19", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "id": "CVE-2026-96417", "lastModified": "2026-09-29T16:17:17.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96417", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T15:38:16.540898Z", "version": "2.0.3"}}]}, "published": "2026-09-29T10:17:16.353", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21574"}, {"source": "cve@gitlab.com", "url": "https://www.wireshark.org/security/wnpa-sec-2026-104.html"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{"bugzilla": {"description": "wireshark: wireshark: Denial of Service via malformed RF4CE packet", "id": "2543039", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543039"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in Wireshark. By convincing a user to open a specially crafted capture file containing malformed Radio Frequency for Consumer Electronics (RF4CE) network traffic, an attacker can cause the RF4CE protocol dissector to crash. This issue primarily results in a Denial of Service (DoS) by terminating the application."], "mitigation": {"lang": "en:us", "value": "Disable the RF4CE dissector in Wireshark or tshark to prevent processing of malformed packets:\n1. Graphical user interface:\nNavigate to Analyze -> Enabled Protocols, search for \"RF4CE\", uncheck the checkbox, and click OK.\n2. Command-line interface (tshark):\nInvoke tshark with the protocol disabled:\n```\ntshark --disable-protocol rf4ce -r <capture_file>\n```\n3. Configuration file:\nAdd the protocol identifier to the disabled protocols configuration file:\n```\necho \"rf4ce\" >> ~/.config/wireshark/disabled_protos\n```\nCaveats:\nDisabling the RF4CE dissector prevents Wireshark from decoding RF4CE frames, displaying them only as raw payload data. Active Wireshark processes must be restarted for configuration file changes to take effect. As a general operational security practice, do not run Wireshark or tshark with elevated (root) privileges when inspecting untrusted capture files."}, "name": "CVE-2026-96417", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-29T09:30:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96417\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96417\nhttps://gitlab.com/wireshark/wireshark/-/work_items/21574\nhttps://www.wireshark.org/security/wnpa-sec-2026-104.html"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.6.0,4.6.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.19)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Wireshark", "source": "cna", "vendor": "Wireshark Foundation"}, "product": "wireshark", "vendor": "wireshark"}], "created": "2026-09-29T16:00:15.023784+00:00", "updated": "2026-09-29T16:00:15.023804+00:00", "vendors": ["wireshark", "wireshark$PRODUCT$wireshark"]}