CVE-2026-95387 is a high severity (CVSS 8.1 in the record) crash in the SPDY protocol dissector of Wireshark 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. A malformed packet or capture file can crash the application. The fixed versions are 4.6.9 and 4.4.19.
What's affected
Wireshark's advisory wnpa-sec-2026-97 lists 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 as affected, and 4.6.9 and 4.4.19 as fixed. The record's weakness is CWE-122, heap based buffer overflow.
Where sources differ. The record scores this 8.1 high. Wireshark's advisory gives no score and describes the impact as a crash, adding that the project is unaware of any exploits. The public upstream issue calls the worst case a CVSS 8.8 heap overflow from an integer overflow while assembling SPDY data frames, notes that Wireshark's own triage would likely class it as denial of service at about 6.5, and says code execution was not demonstrated. It also reports that the code is present in the development branch.
In short: confirmed crash, possible worse impact not ruled out, no known exploitation.
How to check if you're exposed
Check the Wireshark version on every analyst workstation, jump host and capture server. On the command line:
wireshark -v
tshark -v
In the desktop app, use Help and About. Versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 are affected.
Also consider where Wireshark or tshark parse traffic you do not control: shared capture servers, automated analysis jobs and pipelines that open files from outside.
What to do now
- Upgrade to Wireshark 4.6.9 or 4.4.19 or later, which are the versions the advisory names.
- Update tshark and any other Wireshark based tools, including bundled copies in appliances or containers.
- Avoid opening capture files from untrusted sources on a workstation that holds sensitive data.
- Run automated packet analysis in a sandbox or container with limited privileges.
- Disable dissectors you do not need if you analyze untrusted traffic and cannot upgrade yet.
Why it matters
Protocol dissectors parse hostile input by design, since the whole point of the tool is to read traffic it did not create. A dissector bug therefore turns into a risk whenever someone opens a file or watches a network they do not control. The upstream report describes a length counter that wraps around when it adds up frame sizes, so the buffer allocated is far smaller than the data copied into it.
The vendor sees the confirmed impact as a crash, and the record does not mark exploitation. The CVE is not in CISA's catalog. The reasonable posture is to patch in the normal cycle and to be careful with files from outside.
Quick check
Is this exploited in the wild?
Wireshark says it is unaware of any exploits, and the CVE is not in CISA's catalog.
Why do the scores differ?
The record uses 8.1. The upstream issue gives a worst case of 8.8 and a likely triage of about 6.5. The advisory gives no score.
Sources
Last reviewed: 18 October 2026.
