CVE-2026-95395
published 2026-09-29CVE-2026-95395: IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
PriorityP416medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.14%
3.1th percentile
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | wireshark | — | — |
| wireshark | wireshark | — | — |
| wireshark | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
| wireshark_foundation | wireshark | >= 4.4.0 < 4.4.19 | 4.4.19 |
| wireshark_foundation | wireshark | >= 4.6.0 < 4.6.9 | 4.6.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
Missing Release of Memory after Effective Lifetime in Wireshark
vendor_gitlab·2026-09-29·CVSS 5.5
CVE-2026-95395 [MEDIUM] CWE-401 Missing Release of Memory after Effective Lifetime in Wireshark
Missing Release of Memory after Effective Lifetime in Wireshark
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Affected products: Wireshark
Affected versions: >=4.6.0, =4.4.0, <4.4.19 (affected)
Solution: Upgrade to version 4.6.9 or above
Credit: Liu Tianzhuo (刘天卓)
Red Hat
wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
vendor_redhat·2026-09-29·CVSS 5.5
CVE-2026-95395 [MEDIUM] CWE-772 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
A flaw was found in Wireshark. A memory leak in the IEEE C37.118 Synchrophasor protocol dissector can allow an attacker to cause a Denial of Service (DoS). By convincing a user to open a maliciously crafted packet capture file, the dissector fails to release allocated memory during packet dissection. This continuous memory consumption can lead to resource exhaustion, ultimately causing the application to crash or become unresponsive.
Mitigation: Operational mitigation can be achieved by avoiding the inspection of untrusted packet captures or capturing traffic on untrusted networks.
Additionally, the affected protocol parser can be disabled in the Wireshark user interface:
1. Open Wireshark and
VulDB
Wireshark up to 4.4.18/4.6.8 Dissector memory leak (Nessus ID 362908)
vuldb·2026-10-05·CVSS 5.5
CVE-2026-95395 [MEDIUM] Wireshark up to 4.4.18/4.6.8 Dissector memory leak (Nessus ID 362908)
A vulnerability classified as problematic has been found in Wireshark up to 4.4.18/4.6.8. The affected element is an unknown function of the component Dissector. The manipulation leads to memory leak.
This vulnerability is listed as CVE-2026-95395. The attack must be carried out locally. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
ghsa_unreviewed·2026-09-29
CVE-2026-95395 [MEDIUM] CWE-401 IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-95395 [MEDIUM] CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Bugzilla
CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector [fedora-all]
bugzilla·2026-09-29·CVSS 5.5
CVE-2026-95395 [MEDIUM] CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector [fedora-all]
CVE-2026-95395 wireshark: wireshark: Denial of Service via memory leak in IEEE C37.118 Synchrophasor dissector [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
2026-09-29
Published