CVE-2026-96422 - Vulnerability Details - OpenCVE

Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Wireshark	Wireshark

Configuration 1 [-]

OR	cpe:2.3:a:wireshark:wireshark::::::::
	cpe:2.3:a:wireshark:wireshark::::::::

No data.

References

Link	Providers
https://gitlab.com/wireshark/wireshark/-/work_items/21525
https://nvd.nist.gov/vuln/detail/CVE-2026-96422
https://www.cve.org/CVERecord?id=CVE-2026-96422
https://www.wireshark.org/security/wnpa-sec-2026-102.html

History

Tue, 06 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wireshark:wireshark::::::::

Wed, 30 Sep 2026 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wireshark Wireshark wireshark
Vendors & Products		Wireshark Wireshark wireshark

Tue, 29 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Title		Reachable Assertion in Wireshark
Weaknesses		CWE-617
References		https://gitlab.com/wireshark/wireshark/-/work_items/21525 https://nvd.nist.gov/vuln/detail/CVE-2026-96422 https://www.cve.org/CVERecord?id=CVE-2026-96422 https://www.wireshark.org/security/wnpa-sec-2026-102.html
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2026-09-29T09:31:08.020Z

Updated: 2026-09-29T15:43:57.112Z

Reserved: 2026-09-23T05:41:55.661Z

Link: CVE-2026-96422

Vulnrichment

Updated: 2026-09-29T15:43:52.439Z

NVD

Status : Analyzed

Published: 2026-09-29T10:17:17.077

Modified: 2026-10-06T14:41:22.523

Link: CVE-2026-96422

Redhat

Severity : Moderate

Publid Date: 2026-09-29T09:31:08Z

Links: CVE-2026-96422 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96422", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-09-23T05:41:55.661Z", "datePublished": "2026-09-29T09:31:08.020Z", "dateUpdated": "2026-09-29T15:43:57.112Z"}, "containers": {"cna": {"title": "Reachable Assertion in Wireshark", "descriptions": [{"lang": "en", "value": "Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.9", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-617: Reachable Assertion", "cweId": "CWE-617", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-102.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.9 or above"}], "credits": [{"lang": "en", "value": "Mayank Jangid (OpenSec Intelligence)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-09-29T09:31:08.020Z"}}, "adp": [{"references": [{"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T15:43:28.054248Z", "id": "CVE-2026-96422", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T15:43:57.112Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96422", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-09-23T05:41:55.661Z", "datePublished": "2026-09-29T09:31:08.020Z", "dateUpdated": "2026-09-29T15:43:57.112Z"}, "containers": {"cna": {"title": "Reachable Assertion in Wireshark", "descriptions": [{"lang": "en", "value": "Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.9", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-617: Reachable Assertion", "cweId": "CWE-617", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-102.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.9 or above"}], "credits": [{"lang": "en", "value": "Mayank Jangid (OpenSec Intelligence)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-09-29T09:31:08.020Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96422", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T15:43:28.054248Z"}}}], "references": [{"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T15:43:52.439Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.9", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.19", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAD22723-8869-4722-B384-904979CBDEDC", "versionEndExcluding": "4.4.19", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*", "matchCriteriaId": "92DC0FDA-DA30-4D3F-B55A-4C3BEA0C7C4C", "versionEndExcluding": "4.6.9", "versionStartIncluding": "4.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"}], "id": "CVE-2026-96422", "lastModified": "2026-10-06T14:41:22.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96422", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T15:43:28.054248Z", "version": "2.0.3"}}]}, "published": "2026-09-29T10:17:17.077", "references": [{"source": "cve@gitlab.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525"}, {"source": "cve@gitlab.com", "tags": ["Vendor Advisory"], "url": "https://www.wireshark.org/security/wnpa-sec-2026-102.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21525"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "cve@gitlab.com", "type": "Secondary"}]}