CVE-2026-0962
📋 TL;DR
A vulnerability in Wireshark's SOME/IP-SD protocol dissector causes crashes when processing malicious packets, leading to denial of service. This affects users running Wireshark versions 4.6.0-4.6.2 and 4.4.0-4.4.12 for network analysis or packet capture.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark crashes repeatedly when analyzing malicious network traffic, preventing network analysis and potentially disrupting monitoring or troubleshooting workflows.
Likely Case
Wireshark crashes when encountering specially crafted SOME/IP-SD packets, requiring restart and potentially losing unsaved capture data.
If Mitigated
Minimal impact if Wireshark is not used for analyzing SOME/IP-SD traffic or if workarounds are implemented.
🎯 Exploit Status
Exploitation requires the attacker to inject malicious packets into network traffic that Wireshark is monitoring or analyzing from capture files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 4.6.3 and 4.4.13
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2026-03.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark from wireshark.org. 2. Install over existing version. 3. Restart Wireshark and any related services.
🔧 Temporary Workarounds
Disable SOME/IP-SD dissector
allPrevent Wireshark from parsing SOME/IP-SD protocol to avoid crashes
Edit -> Preferences -> Protocols -> SOME/IP-SD -> Uncheck 'Enable SOME/IP-SD protocol'
Use capture filters
allFilter out SOME/IP-SD traffic during capture to prevent exposure
Capture -> Options -> Capture Filter: not port 30490
🧯 If You Can't Patch
- Restrict Wireshark use to trusted networks without SOME/IP-SD traffic
- Monitor for Wireshark crashes and investigate network traffic when crashes occur
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version via Help -> About Wireshark. If version is 4.6.0-4.6.2 or 4.4.0-4.4.12, you are vulnerable.Check Version:
wireshark -v (Linux/macOS) or check Help -> About on WindowsVerify Fix Applied:
Verify Wireshark version is 4.6.3+ or 4.4.13+ after update.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application error events mentioning Wireshark
Network Indicators:
- Malformed SOME/IP-SD packets on monitored networks
- UDP port 30490 traffic with unusual patterns
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="wireshark.exe" OR "Wireshark"