wireshark: Heap-based Buffer Overflow in Wireshark
cve CVE-2026-95393 3 sources, 3 claims · Watch
What it is to other things
In words only, so not counted until a person confirms one:
| affects | wireshark_foundation/wiresharkNVD says “Wireshark Foundation · Wireshark” |
| made_by | wireshark_foundationNVD says “Wireshark Foundation” |
What each source says
| Property | Source | Said | Means here | ||||
|---|---|---|---|---|---|---|---|
| Cvss cvss conflict | GitHub advisories | 4.7receipt
What the source handed over{
"credits": [],
"cve_id": "CVE-2026-95393",
"cvss": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_severities": {
"cvss_v3": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_v4": {
"score": 0.0,
"vector_string": null
}
},
"cwes": [
{
"cwe_id": "CWE-122",
"name": "Heap-based Buffer Overflow"
}
],
"description": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"epss": {
"percentage": 0.00128,
"percentile": 0.02056
},
"ghsa_id": "GHSA-jp3x-6949-38v9",
"github_reviewed_at": null,
"html_url": "https://github.com/advisories/GHSA-jp3x-6949-38v9",
"identifiers": [
{
"type": "GHSA",
"value": "GHSA-jp3x-6949-38v9"
},
{
"type": "CVE",
"value": "CVE-2026-95393"
}
],
"nvd_published_at": "2026-09-29T10:17:15Z",
"published_at": "2026-09-29T12:31:30Z",
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-95393",
"https://gitlab.com/wireshark/wireshark/-/work_items/21510",
"https://www.wireshark.org/security/wnpa-sec-2026-99.html",
"https://github.com/advisories/GHSA-jp3x-6949-38v9"
],
"repository_advisory_url": null,
"severity": "medium",
"source_code_location": "",
"summary": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"type": "unreviewed",
"updated_at": "2026-09-29T12:31:38Z",
"url": "https://api.github.com/advisories/GHSA-jp3x-6949-38v9",
"vulnerabilities": [],
"withdrawn_at": null
} | — | ||||
| Cvss cvss conflict | NVD | 4.7receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"repo": "https://gitlab.com/wireshark/wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.9",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.19",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "cve@gitlab.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"
}
],
"id": "CVE-2026-95393",
"lastModified": "2026-09-29T21:36:39.547",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6,
"source": "cve@gitlab.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-95393",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:46:53.215496Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-29T10:17:15.610",
"references": [
{
"source": "cve@gitlab.com",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
},
{
"source": "cve@gitlab.com",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-99.html"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
}
],
"sourceIdentifier": "cve@gitlab.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "cve@gitlab.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Cvss cvss conflict | Red Hat | 5.3receipt
What the source handed over{
"CVE": "CVE-2026-95393",
"CWE": "CWE-787",
"advisories": [],
"affected_packages": [],
"bugzilla": "2543030",
"bugzilla_description": "wireshark: Heap-based Buffer Overflow in Wireshark",
"cvss3_score": "5.3",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2026-09-29T09:33:03Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-95393.json",
"severity": "moderate"
} | — | ||||
| Cwe cwe not compared | GitHub advisories | CWE-122receipt
What the source handed over{
"credits": [],
"cve_id": "CVE-2026-95393",
"cvss": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_severities": {
"cvss_v3": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_v4": {
"score": 0.0,
"vector_string": null
}
},
"cwes": [
{
"cwe_id": "CWE-122",
"name": "Heap-based Buffer Overflow"
}
],
"description": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"epss": {
"percentage": 0.00128,
"percentile": 0.02056
},
"ghsa_id": "GHSA-jp3x-6949-38v9",
"github_reviewed_at": null,
"html_url": "https://github.com/advisories/GHSA-jp3x-6949-38v9",
"identifiers": [
{
"type": "GHSA",
"value": "GHSA-jp3x-6949-38v9"
},
{
"type": "CVE",
"value": "CVE-2026-95393"
}
],
"nvd_published_at": "2026-09-29T10:17:15Z",
"published_at": "2026-09-29T12:31:30Z",
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-95393",
"https://gitlab.com/wireshark/wireshark/-/work_items/21510",
"https://www.wireshark.org/security/wnpa-sec-2026-99.html",
"https://github.com/advisories/GHSA-jp3x-6949-38v9"
],
"repository_advisory_url": null,
"severity": "medium",
"source_code_location": "",
"summary": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"type": "unreviewed",
"updated_at": "2026-09-29T12:31:38Z",
"url": "https://api.github.com/advisories/GHSA-jp3x-6949-38v9",
"vulnerabilities": [],
"withdrawn_at": null
} | — | ||||
| Cwe cwe not compared | Red Hat | CWE-787receipt
What the source handed over{
"CVE": "CVE-2026-95393",
"CWE": "CWE-787",
"advisories": [],
"affected_packages": [],
"bugzilla": "2543030",
"bugzilla_description": "wireshark: Heap-based Buffer Overflow in Wireshark",
"cvss3_score": "5.3",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2026-09-29T09:33:03Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-95393.json",
"severity": "moderate"
} | — | ||||
| Product product | NVD | Wiresharkreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"repo": "https://gitlab.com/wireshark/wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.9",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.19",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "cve@gitlab.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"
}
],
"id": "CVE-2026-95393",
"lastModified": "2026-09-29T21:36:39.547",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6,
"source": "cve@gitlab.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-95393",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:46:53.215496Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-29T10:17:15.610",
"references": [
{
"source": "cve@gitlab.com",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
},
{
"source": "cve@gitlab.com",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-99.html"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
}
],
"sourceIdentifier": "cve@gitlab.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "cve@gitlab.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Severity severity | GitHub advisories | mediumreceipt
What the source handed over{
"credits": [],
"cve_id": "CVE-2026-95393",
"cvss": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_severities": {
"cvss_v3": {
"score": 4.7,
"vector_string": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"cvss_v4": {
"score": 0.0,
"vector_string": null
}
},
"cwes": [
{
"cwe_id": "CWE-122",
"name": "Heap-based Buffer Overflow"
}
],
"description": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"epss": {
"percentage": 0.00128,
"percentile": 0.02056
},
"ghsa_id": "GHSA-jp3x-6949-38v9",
"github_reviewed_at": null,
"html_url": "https://github.com/advisories/GHSA-jp3x-6949-38v9",
"identifiers": [
{
"type": "GHSA",
"value": "GHSA-jp3x-6949-38v9"
},
{
"type": "CVE",
"value": "CVE-2026-95393"
}
],
"nvd_published_at": "2026-09-29T10:17:15Z",
"published_at": "2026-09-29T12:31:30Z",
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-95393",
"https://gitlab.com/wireshark/wireshark/-/work_items/21510",
"https://www.wireshark.org/security/wnpa-sec-2026-99.html",
"https://github.com/advisories/GHSA-jp3x-6949-38v9"
],
"repository_advisory_url": null,
"severity": "medium",
"source_code_location": "",
"summary": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service",
"type": "unreviewed",
"updated_at": "2026-09-29T12:31:38Z",
"url": "https://api.github.com/advisories/GHSA-jp3x-6949-38v9",
"vulnerabilities": [],
"withdrawn_at": null
} | — | ||||
| Severity severity | Red Hat | moderate A flaw that is harder to exploit, or whose impact is limited. receipt
What the source handed over{
"CVE": "CVE-2026-95393",
"CWE": "CWE-787",
"advisories": [],
"affected_packages": [],
"bugzilla": "2543030",
"bugzilla_description": "wireshark: Heap-based Buffer Overflow in Wireshark",
"cvss3_score": "5.3",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2026-09-29T09:33:03Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-95393.json",
"severity": "moderate"
} | medium | ||||
| Status status | NVD | Awaiting Analysisreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"repo": "https://gitlab.com/wireshark/wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.9",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.19",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "cve@gitlab.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"
}
],
"id": "CVE-2026-95393",
"lastModified": "2026-09-29T21:36:39.547",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6,
"source": "cve@gitlab.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-95393",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:46:53.215496Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-29T10:17:15.610",
"references": [
{
"source": "cve@gitlab.com",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
},
{
"source": "cve@gitlab.com",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-99.html"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
}
],
"sourceIdentifier": "cve@gitlab.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "cve@gitlab.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Vendor vendor | NVD | Wireshark Foundationreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Wireshark",
"repo": "https://gitlab.com/wireshark/wireshark",
"vendor": "Wireshark Foundation",
"versions": [
{
"lessThan": "4.6.9",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"lessThan": "4.4.19",
"status": "affected",
"version": "4.4.0",
"versionType": "semver"
}
]
}
],
"source": "cve@gitlab.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service"
}
],
"id": "CVE-2026-95393",
"lastModified": "2026-09-29T21:36:39.547",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.6,
"source": "cve@gitlab.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-95393",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:46:53.215496Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-29T10:17:15.610",
"references": [
{
"source": "cve@gitlab.com",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
},
{
"source": "cve@gitlab.com",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-99.html"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21510"
}
],
"sourceIdentifier": "cve@gitlab.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "cve@gitlab.com",
"type": "Secondary"
}
]
}
} | — |
vulnerability
| wireshark: Heap-based Buffer Overflow in Wireshark zetlyn/cve-redhat · 2026-09-29 | cvss 5.3 cwe CWE-787 severity moderate | source |
| CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service zetlyn/cve-nvd · 2026-09-29 | cvss 4.7 product Wireshark status Awaiting Analysis vendor Wireshark Foundation | source |
| CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service zetlyn/cve-ghsa · 2026-09-29 | cvss 4.7 cwe CWE-122 severity medium | source |