CVE-2026-95392
published 2026-09-29CVE-2026-95392: MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
PriorityP417medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.15%
4.1th percentile
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | wireshark | — | — |
| wireshark | wireshark | — | — |
| wireshark | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
| wireshark_foundation | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark_foundation | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Wireshark up to 4.4.18/4.6.8 MBIM Protocol Dissector denial of service (Nessus ID 362908)
vuldb·2026-10-05·CVSS 5.5
CVE-2026-95392 [MEDIUM] Wireshark up to 4.4.18/4.6.8 MBIM Protocol Dissector denial of service (Nessus ID 362908)
A vulnerability marked as problematic has been reported in Wireshark up to 4.4.18/4.6.8. This issue affects some unknown processing of the component MBIM Protocol Dissector. Performing a manipulation results in denial of service.
This vulnerability is identified as CVE-2026-95392. The attack is only possible with local access. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
ghsa_unreviewed·2026-09-29
CVE-2026-95392 [MEDIUM] CWE-126 MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
GitLab
Buffer Over-read in Wireshark
vendor_gitlab·2026-09-29·CVSS 5.5
CVE-2026-95392 [MEDIUM] CWE-126 Buffer Over-read in Wireshark
Buffer Over-read in Wireshark
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected products: Wireshark
Affected versions: >=4.6.0, =4.4.0, <4.4.19 (affected)
Solution: Upgrade to version 4.6.9 or above
Credit: Mayank Jangid (OpenSec Intelligence)
Red Hat
wireshark: Buffer Over-read in Wireshark
vendor_redhat·2026-09-29·CVSS 5.5
CVE-2026-95392 [MEDIUM] CWE-126 wireshark: Buffer Over-read in Wireshark
wireshark: Buffer Over-read in Wireshark
A flaw was found in the MBIM protocol dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a buffer over-read, resulting in a denial of service.
Statement: This issue will cause a crash in Wireshark with no other security impact. Also, this flaw can only be exploited when malformed packets from a pcap file or the network are processed. Due to these reasons, this vulnerability has been rated with a moderate severity.
Mitigation: If the MBIM protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool.
See the links below for ins
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-95392 wireshark: Buffer Over-read in Wireshark [fedora-all]
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-95392 [MEDIUM] CVE-2026-95392 wireshark: Buffer Over-read in Wireshark [fedora-all]
CVE-2026-95392 wireshark: Buffer Over-read in Wireshark [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Bugzilla
CVE-2026-95392 wireshark: Buffer Over-read in Wireshark
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-95392 [MEDIUM] CVE-2026-95392 wireshark: Buffer Over-read in Wireshark
CVE-2026-95392 wireshark: Buffer Over-read in Wireshark
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
2026-09-29
Published