# CVE-2026-95389: Wireshark SCTP dissector integer overflow heap buffer overflow

Source: https://junglewise.ai/threats/cve-2026-95389-sctp-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-95389 · Severity: high · CVSS 8.1 · Published 2026-09-29

Wireshark, a network protocol analyzer used to inspect and troubleshoot network traffic, contains a critical flaw in its SCTP protocol dissector. An attacker can craft malicious SCTP network packets or pcap files that trigger a heap buffer overflow through integer overflow, potentially allowing arbitrary code execution with the privileges of the Wireshark process. This could allow an attacker to execute code on a victim's system if they trick them into analyzing a malicious packet trace or if malicious traffic is sent across their network.

Technologies: [Wireshark Foundation Wireshark](https://junglewise.ai/threats/technologies/wireshark-foundation-wireshark). Vendors: [Wireshark Foundation](https://junglewise.ai/threats/vendors/wireshark-foundation).

## Quick answers

**Is CVE-2026-95389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95389 being exploited in the wild.

**How severe is CVE-2026-95389?** High severity, with a CVSS score of 8.1, published 29 September 2026.

**Which products and versions are affected?** Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.

**Is there a fix for CVE-2026-95389?** A patch was published on 2026-09-23: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95389 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-95389?** Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow in the fragment_reassembly() function in packet-sctp.c allows accumulation of SCTP fragment lengths across an unbounded number of fragments without overflow checks. When the accumulated length exceeds 2^32 bytes, the uint32_t variable wraps to a small value, which is then used to allocate a tiny heap buffer. Subsequent memcpy() operations write gigabytes of attacker-controlled data past the allocation boundary. The vulnerability requires sending multiple SCTP fragments in a single message but no per-packet validation catches the cumulative overflow, and the attack can be delivered via network traffic or malicious pcap files.

## Affected products

- Wireshark Foundation Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8

## Timeline

- 2026-09-23: disclosed: Wireshark security advisory wnpa-sec-2026-93 published
- 2026-09-23: patched: Fixed in versions 4.6.9 and 4.4.19

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21481](https://gitlab.com/wireshark/wireshark/-/work_items/21481)
- [https://www.wireshark.org/security/wnpa-sec-2026-93.html](https://www.wireshark.org/security/wnpa-sec-2026-93.html)

## Related threats

- [Wireshark X11 dissector out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-96423-x11-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4)
- [Wireshark Frame protocol metadissector crash](https://junglewise.ai/threats/cve-2026-96422-frame-protocol-metadissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to)
- [Wireshark Toshiba file parser crash](https://junglewise.ai/threats/cve-2026-96420-toshiba-file-parser-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18)
- [Wireshark profile import path traversal code execution](https://junglewise.ai/threats/cve-2026-96419-profile-import-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18-allows)
- [Wireshark TIFF dissector infinite loop](https://junglewise.ai/threats/cve-2026-96418-tiff-protocol-dissector-infinite-loop-in-4-6-0-to-4-6-8-and-4-4-0)