# CVE-2026-95387: Wireshark SPDY dissector integer overflow in frame reassembly

Source: https://junglewise.ai/threats/cve-2026-95387-spdy-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-95387 · Severity: high · CVSS 8.1 · Published 2026-09-29

Wireshark, a packet analyzer used by network administrators and security professionals to inspect network traffic, contains an integer overflow vulnerability in its SPDY protocol dissector. An attacker who crafts a malicious network packet or packet capture file can trigger a heap buffer overflow, crashing Wireshark and potentially enabling arbitrary code execution. The vulnerability requires no authentication but does require the victim to open the malicious traffic file or have the packet injected onto their network.

Technologies: [Wireshark Foundation Wireshark](https://junglewise.ai/threats/technologies/wireshark-foundation-wireshark). Vendors: [Wireshark Foundation](https://junglewise.ai/threats/vendors/wireshark-foundation).

## Quick answers

**Is CVE-2026-95387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95387 being exploited in the wild.

**How severe is CVE-2026-95387?** High severity, with a CVSS score of 8.1, published 29 September 2026.

**Which products and versions are affected?** Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.

**Is there a fix for CVE-2026-95387?** A patch was published on 2026-09-23: Version 4.6.9, 4.4.19 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95387 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-95387?** Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a uint32_t integer overflow in the spdy_assemble_data_frames() function within packet-spdy.c. The function accumulates the lengths of fragmented SPDY DATA frames without overflow protection; when total fragment length exceeds 2^32 bytes, the datalen variable wraps to a small value and is passed to wmem_alloc(), creating a heap buffer undersized relative to the actual data. Subsequent memcpy() operations write ~4.3 GB of attacker-controlled data past the allocation boundary, corrupting heap memory. Attack vector is network-based (via crafted packets) or local (via malicious pcap files), requires user interaction to open the file, and can cause denial of service; code execution has not been demonstrated.

## Affected products

- Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8

## Timeline

- 2026-09-29: disclosed
- 2026-09-23: patched: Version 4.6.9, 4.4.19 released

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21487](https://gitlab.com/wireshark/wireshark/-/work_items/21487)
- [https://www.wireshark.org/security/wnpa-sec-2026-97.html](https://www.wireshark.org/security/wnpa-sec-2026-97.html)

## Related threats

- [Wireshark X11 dissector out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-96423-x11-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4)
- [Wireshark Frame protocol metadissector crash](https://junglewise.ai/threats/cve-2026-96422-frame-protocol-metadissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to)
- [Wireshark Toshiba file parser crash](https://junglewise.ai/threats/cve-2026-96420-toshiba-file-parser-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18)
- [Wireshark profile import path traversal code execution](https://junglewise.ai/threats/cve-2026-96419-profile-import-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18-allows)
- [Wireshark TIFF dissector infinite loop](https://junglewise.ai/threats/cve-2026-96418-tiff-protocol-dissector-infinite-loop-in-4-6-0-to-4-6-8-and-4-4-0)