CVE-2026-96423 is a medium severity (CVSS 5.5) crash in the X11 protocol dissector of Wireshark 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. A malformed packet or capture file can crash the application. Wireshark says the fixed versions are 4.6.9 and 4.4.19, so upgrade soon.
What's affected
Wireshark advisory wnpa-sec-2026-108 lists 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 as affected, with fixes in 4.6.9 and 4.4.19. The record lists CWE-122 and CWE-125, heap overflow and out of bounds read. The upstream issue describes an out of bounds heap read in the keysym lookup, caused by a cached width that goes stale when the width changes between messages.
The advisory describes a crash, says the project is unaware of exploits, and says a crash may be caused by injecting a malformed packet on the wire or by getting someone to open a malformed trace file. The record's local vector with user interaction and an availability impact agrees with the file route. The advisory credits the discovery to an AI agent working with Ada Logics.
How to check if you're exposed
Check the version on every system where Wireshark or tshark runs.
wireshark -v
tshark -v
Versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 are in scope. X11 traffic is now rare on modern networks, but the dissector still runs on any capture that contains it, including files that someone hands to an analyst.
What to do now
- Upgrade to Wireshark 4.6.9 or 4.4.19 or later.
- Update tshark and any bundled copies of Wireshark libraries in tools and appliances.
- Do not open captures from unknown sources on machines with sensitive data.
- If you run automatic analysis on uploaded captures, do it in an isolated container with limits on memory and time.
- Include this with the other Wireshark fixes from the same release so you only touch the tool once.
Why it matters
An out of bounds read means the program looks at memory past the end of a buffer. Most often that ends in a crash, and sometimes in leaked data. CWE-125 is a common result of caching a size that later stops matching the data it describes. The fix is to carry the right width with each array so a stale value cannot be used.
The record scores this medium and the vendor describes a crash only. It is not in CISA's catalog. For most teams this is a tidy up item that rides along with the same release that fixes the SPDY and profile import issues.
Quick check
Does this need a network attacker?
Not necessarily. The advisory says a malformed packet or a trace file can trigger it.
What versions fix it?
Wireshark 4.6.9 and 4.4.19, per the advisory.
Sources
Last reviewed: 18 October 2026.
