Is CVE-2026-95388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95388 being exploited in the wild.

How severe is CVE-2026-95388?

Medium severity, with a CVSS score of 5.5, published 29 September 2026.

Which products and versions are affected?

Wireshark Foundation Sharkd 4.4.0 to 4.4.18, 4.6.0 to 4.6.8; Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.

Is there a fix for CVE-2026-95388?

A patch was published on 2026-09-23: Fixed versions 4.4.19, 4.6.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95388 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-95388?

Check whether you run Wireshark Foundation Sharkd or Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95388: Wireshark Sharkd RTP resampler buffer overflow denial of service

CVE-2026-95388 · Severity: medium · CVSS 5.5 · Published 2026-09-29

Sharkd is a backend utility in Wireshark that analyzes network traffic through a JSON interface, including the ability to export audio streams from captured RTP packets. A specially crafted RTP capture with conflicting audio sample rates can trigger a buffer overflow in the resampling code, causing Sharkd to crash and terminating the analysis session. An attacker who can supply a malicious capture file to an analyst can use this to deny service.

Technologies: Wireshark Foundation Wireshark. Vendors: Wireshark Foundation.

Quick answers

Is CVE-2026-95388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95388 being exploited in the wild.
How severe is CVE-2026-95388?: Medium severity, with a CVSS score of 5.5, published 29 September 2026.
Which products and versions are affected?: Wireshark Foundation Sharkd 4.4.0 to 4.4.18, 4.6.0 to 4.6.8; Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.
Is there a fix for CVE-2026-95388?: A patch was published on 2026-09-23: Fixed versions 4.4.19, 4.6.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95388 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-95388?: Check whether you run Wireshark Foundation Sharkd or Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an integer wrap in 32-bit arithmetic within the RTP resampler output-size calculation in sharkd_session.c. When processing RTP packets with two widely different L16 clock rates (e.g., 8,388,609 Hz and 1 Hz), the multiplication of audio_out_rate_ by payload length overflows, causing the subsequent buffer-size check to pass despite insufficient space, and the resampler writes far beyond the 4 KiB destination buffer. The attack requires only that the crafted capture be readable by Sharkd and that a normal RTP download operation be performed; it does not require authentication or Sharkd request forgery.

Affected products

Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8
Wireshark Foundation Sharkd 4.4.0 to 4.4.18, 4.6.0 to 4.6.8

Timeline

2026-09-23: disclosed
2026-09-29: advisory
2026-09-23: patched: Fixed versions 4.4.19, 4.6.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.