CVE-2026-0959: 
Wireshark vulnerability analysis and mitigation

CVE-2026-0959 is an out-of-bounds write vulnerability in the IEEE 802.11 protocol dissector in Wireshark that allows a remote attacker to cause a denial of service by crashing the application. It affects Wireshark versions 4.4.0 through 4.4.12 and 4.6.0 through 4.6.2. The vulnerability was disclosed on January 14, 2026, and assigned by GitLab Inc. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, and 5.3 (Medium) per the CNA (GitLab Inc.) (Wireshark Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in Wireshark's IEEE 802.11 wireless protocol dissector. An attacker can craft malicious IEEE 802.11 wireless packets that, when processed by Wireshark, trigger the out-of-bounds write and cause the dissector to crash. Exploitation requires user interaction — the victim must open or capture the malicious packets — but requires no privileges and can be initiated remotely over the network. The vulnerability is tracked in the Wireshark issue tracker at GitLab (Wireshark GitLab, Wireshark Advisory).

Successful exploitation results in a denial of service by crashing the Wireshark application, disrupting network monitoring and packet analysis workflows. The impact is limited to availability — there is no confidentiality or integrity impact, and no evidence of code execution capability. Organizations relying on Wireshark for real-time network analysis or forensic investigation may experience interruption to those operations (Wireshark Advisory, Red Hat Bugzilla).

1. Craft malicious packets: Prepare specially crafted IEEE 802.11 wireless frames designed to trigger the out-of-bounds write in Wireshark's 802.11 dissector when parsed.
2. Deliver packets to target: Transmit the malicious packets over a wireless network segment where the target Wireshark instance is capturing traffic, or provide a crafted packet capture file (e.g., .pcap) to the victim.
3. Trigger dissector crash: When the victim opens the capture file or Wireshark processes the live wireless traffic, the IEEE 802.11 dissector encounters the malformed packet, triggers the out-of-bounds write, and crashes.
4. Achieve denial of service: The Wireshark process terminates, disrupting any ongoing network monitoring or analysis session (Wireshark Advisory, Wireshark GitLab).

• Process: Unexpected or repeated crashes of the Wireshark process (wireshark, tshark, or dumpcap) during capture or analysis of IEEE 802.11 wireless traffic.
• Logs: Crash reports or core dump files generated by Wireshark referencing the IEEE 802.11 dissector; application error logs showing segmentation faults or access violations in Wireshark.
• File System: Presence of unexpected or externally supplied .pcap or .pcapng files containing 802.11 frames delivered to analysts for review.
• Network: Anomalous or malformed IEEE 802.11 frames on monitored wireless segments that do not conform to standard protocol structure.

Wireshark has released patched versions addressing this vulnerability: upgrade to 4.4.13 or later for the 4.4.x branch, or 4.6.3 or later for the 4.6.x branch. Organizations unable to patch immediately should limit Wireshark usage to trusted network environments and avoid opening untrusted packet capture files. Network segmentation can reduce exposure of Wireshark instances to untrusted wireless traffic sources (Wireshark Advisory, Wireshark GitLab).

The vulnerability received routine coverage from Linux distribution security channels, including SUSE, Fedora, and Debian package update announcements. Greenbone's January 2026 threat report noted the vulnerability among the month's disclosures. No significant researcher commentary or notable social media discussion beyond automated CVE tracking feeds has been observed (Red Hat Bugzilla).