Is CVE-2026-96421 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96421 being exploited in the wild.

How severe is CVE-2026-96421?

Medium severity, with a CVSS score of 5.5, published 29 September 2026.

Which products and versions are affected?

Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.

Is there a fix for CVE-2026-96421?

A patch was published on 2026: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96421 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-96421?

Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96421: Wireshark USB HID dissector infinite loop in Usage range parsing

CVE-2026-96421 · Severity: medium · CVSS 5.5 · Published 2026-09-29

Wireshark's USB packet analyzer contains a flaw in how it parses USB device descriptor files that could cause the application to hang indefinitely and consume all available memory. An attacker can craft a malicious USB capture file that, when opened in Wireshark, will freeze the program and exhaust system resources, causing a denial of service. No data is exposed or modified by this vulnerability.

Technologies: Wireshark. Vendors: Wireshark.

Quick answers

Is CVE-2026-96421 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96421 being exploited in the wild.
How severe is CVE-2026-96421?: Medium severity, with a CVSS score of 5.5, published 29 September 2026.
Which products and versions are affected?: Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8.
Is there a fix for CVE-2026-96421?: A patch was published on 2026: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96421 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-96421?: Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The USB HID dissector's parse_report_descriptor() function uses an unchecked uint32_t loop counter when expanding Usage Minimum/Maximum ranges. When usage_max is 0xFFFFFFFF, the loop counter wraps from 0xFFFFFFFF to 0 on the next increment, creating an infinite loop that continuously appends to an unbounded wmem array. The existing bounds check (MAX_REPORT_DESCRIPTOR_COUNT) only validates the declared range delta, not the absolute wraparound, allowing malformed descriptors with usage_min=0xFFFFFFFE and usage_max=0xFFFFFFFF to bypass all protections.

Affected products

Wireshark Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.8

Timeline

2026-09-23: disclosed
2026: patched: Fixed in versions 4.6.9 and 4.4.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.