CVE-2026-96423

A flaw was found in Wireshark. A heap-based buffer overflow in the X11 protocol dissector allows an attacker to cause a Denial of Service (DoS) by injecting malformed packets or providing a crafted capture file. Successful exploitation leads to an application crash, disrupting network packet inspection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the X11 protocol dissector if analyzing network traffic that does not require X11 packet decoding.

For command-line analysis using tshark, disable the protocol at runtime:

tshark --disable-protocol x11 -r <capture_file>

For persistent user configuration, add the protocol identifier to the disabled protocols file:

mkdir -p ~/.config/wireshark
echo "x11" >> ~/.config/wireshark/disabled_protos

In the Wireshark graphical interface, the dissector can be disabled by navigating to Analyze > Enabled Protocols, searching for "X11", unchecking the protocol entry, and clicking OK.

Caveats: Disabling this dissector prevents Wireshark from decoding and analyzing X11 protocol traffic. Running Wireshark sessions must be restarted for configuration file changes to take effect. Additionally, avoid opening capture files obtained from untrusted sources and avoid running packet capture utilities with elevated root privileges.