CVE-2026-95389: Wireshark SCTP dissector integer overflow heap buffer overflow

CVE-2026-95389 · Severity: high · CVSS 8.1 · Published 2026-09-29

Wireshark, a network protocol analyzer used to inspect and troubleshoot network traffic, contains a critical flaw in its SCTP protocol dissector. An attacker can craft malicious SCTP network packets or pcap files that trigger a heap buffer overflow through integer overflow, potentially allowing arbitrary code execution with the privileges of the Wireshark process. This could allow an attacker to execute code on a victim's system if they trick them into analyzing a malicious packet trace or if malicious traffic is sent across their network.

Technologies: Wireshark Foundation Wireshark. Vendors: Wireshark Foundation.

Quick answers

Is CVE-2026-95389 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-95389 being exploited in the wild.
How severe is CVE-2026-95389?
High severity, with a CVSS score of 8.1, published 29 September 2026.
Which products and versions are affected?
Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.
Is there a fix for CVE-2026-95389?
A patch was published on 2026-09-23: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95389 attacked?
It is attacked over the network.
Am I affected by CVE-2026-95389?
Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow in the fragment_reassembly() function in packet-sctp.c allows accumulation of SCTP fragment lengths across an unbounded number of fragments without overflow checks. When the accumulated length exceeds 2^32 bytes, the uint32_t variable wraps to a small value, which is then used to allocate a tiny heap buffer. Subsequent memcpy() operations write gigabytes of attacker-controlled data past the allocation boundary. The vulnerability requires sending multiple SCTP fragments in a single message but no per-packet validation catches the cumulative overflow, and the attack can be delivered via network traffic or malicious pcap files.

Affected products

  • Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8

Timeline

  • 2026-09-23: disclosed: Wireshark security advisory wnpa-sec-2026-93 published
  • 2026-09-23: patched: Fixed in versions 4.6.9 and 4.4.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.