Is CVE-2026-96416 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96416 being exploited in the wild.

How severe is CVE-2026-96416?

Medium severity, with a CVSS score of 5.5, published 29 September 2026.

Which products and versions are affected?

Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18.

Is there a fix for CVE-2026-96416?

A patch was published on 2026-09-29: versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96416 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2026-96416?

Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96416: Wireshark IEEE 802.11 protocol dissector crash

CVE-2026-96416 · Severity: medium · CVSS 5.5 · Published 2026-09-29

Wireshark, a network packet analyzer used by IT professionals to diagnose network issues, contains a flaw in its 802.11 wireless protocol decoder that can crash the application when processing specially crafted wireless frames. An attacker could exploit this by injecting a malicious wireless packet into a network or providing a malformed capture file, causing a denial of service that prevents analysis of network traffic. The vulnerability only affects users who have enabled 802.11 decryption with a configured key, though this is standard practice for wireless security analysis.

Technologies: Wireshark Foundation Wireshark. Vendors: Wireshark Foundation.

Quick answers

Is CVE-2026-96416 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96416 being exploited in the wild.
How severe is CVE-2026-96416?: Medium severity, with a CVSS score of 5.5, published 29 September 2026.
Which products and versions are affected?: Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18.
Is there a fix for CVE-2026-96416?: A patch was published on 2026-09-29: versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96416 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-96416?: Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Dot11DecryptFtMicCheck() function in the IEEE 802.11 Fast BSS Transition dissector, where a length desynchronization between two FTE (Fast Transition Element) elements allows an integer underflow: the function retrieves the FTE element length from one packet store and the MIC length from another, permitting a crafted frame with multiple FTE elements to cause fte_len - 4 - mic_len to underflow (e.g., 20 - 4 - 24 = -8). This negative value is cast to size_t and passed to gcry_mac_write(), causing an out-of-bounds read of approximately 2^64 bytes starting past the allocated buffer boundary. The vulnerability requires decryption to be enabled and a key configured, but needs no authentication, association, or key knowledge—any single unauthenticated management frame triggers the crash before MIC verification.

Affected products

Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18

Timeline

2026-09-23: disclosed
2026-09-29: patched: versions 4.6.9 and 4.4.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.