CVE-2026-95387
Wireshark: heap buffer overflow can lead to denial of service
- Risk score
- 66/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Affected
- Wireshark
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Wireshark: Amber, patch this week. SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
The flaws
- CVE-2026-95387: Heap buffer overflow can lead to denial of service (CVSS 8.8 · EPSS 0%)
- CVE-2026-95389: Heap buffer overflow can lead to denial of service (CVSS 8.1 · EPSS 0%)
- CVE-2026-96419: Path traversal can lead to remote code execution (CVSS 7.8 · EPSS 0%)
- CVE-2026-96423: Heap buffer overflow can lead to denial of service (CVSS 7.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Wireshark
Where it stands
- Public proof of concept
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 397 other warnings in 30 days
- Same product: Earlier Wireshark warnings. 15 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
References
Original description
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Last activity 29 Sep 2026. Patch Forecast updates every hour.