ZDI-26-747: Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability
ZDI disclosed a Wireshark RF4CE parsing buffer overflow enabling remote code execution, CVE-2026-96417.
ZDI-26-747 describes a buffer overflow in Wireshark's RF4CE packet parser that could let a remote attacker run arbitrary code. Exploitation requires the target to open a malicious capture or visit a malicious page. ZDI assigned CVSS 7.8 and CVE-2026-96417. No in-the-wild exploitation is mentioned.
- RF4CE packet parsing has a buffer overflow.
- Successful exploitation can execute arbitrary code.
- User must open a malicious file or page.
- ZDI rates it CVSS 7.8 as CVE-2026-96417.
- CVEs
- CVE-2026-96417
- Vendors
- Wireshark
- Products
- Wireshark
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96417 | RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | 5.5 | <1% | PoC |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Wireshark. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.