Amazon Linux 2023 Security Advisory: ALAS2023-2026-3252
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
FAQs regarding Amazon Linux ALAS/CVE Severity
TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service (CVE-2026-95386)
The spdy_assemble_data_frames() function in epan/dissectors/packet-spdy.c accumulates SPDY DATA frame payload fragment lengths into a uint32_t variable named datalen without any overflow protection. When the total accumulated fragment data exceeds 2^32 bytes (4,294,967,296), the datalen variable wraps to a small value. This wrapped value is then passed to wmem_alloc() as the allocation size, producing a buffer drastically smaller than the actual data. The subsequent memcpy() calls then write the full ~4.3 GB of attacker-controlled fragment data past the end of the tiny allocation, corrupting the heap. (CVE-2026-95387)
Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-95388)
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-95389)
The PEAK TRC v1 ERROR-frame parser splits the data column and passes bytes[0] or bytes[1] to g_ascii_strtoull() without first validating the token count. A malformed 44-byte file therefore dereferences NULL during automatic format detection/read. (CVE-2026-95390)
ZigBee ZCL Touchlink: empty the commissioning map on a redissect. Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file (CVE-2026-95391)
The MBIM protocol dissector could crash. Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. (CVE-2026-95392)
Heap buffer overflow (WRITE) in CSN.1 dissector -- CSN_RECURSIVE_ARRAY writes past destination array with no capacity check (packet-csn1.c). (CVE-2026-95393)
Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-95394)
The SYNCHROPHASOR dissector (packet-synphasor.c) parses CFG3 configuration frames. The function config_3_frame_fast() reads the num_ph (number of phasors) field from the packet without any upper bound check, then allocates 17.8 MB of memory using wmem_file_scope() per frame. This memory is only freed when the capture file is closed, so sending multiple frames causes memory exhaustion and process termination.
A single 78-byte UDP packet to port 4713 triggers a 17.8 MB allocation. 1000 frames (~200 KB on disk) cause ~17 GB of memory consumption, resulting in OOM kill or g_malloc abort. (CVE-2026-95395)
Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service (CVE-2026-96415)
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. The IEEE 802.11 protocol dissector could crash. (CVE-2026-96416)
Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability (CVE-2026-96417)
dissect_tiff() follows the TIFF Image File Directory (IFD) chain by repeatedly calling dissect_tiff_ifd() with the 32-bit "next IFD" offset it reads verbatim from the input. There is no visited-offset set, no requirement that the offset advance, and no iteration cap, so a TIFF whose IFD points its next-IFD field back at itself makes the walker loop over the same bytes forever. A bounds exception cannot rescue it, because the crafted offset is deliberately in bounds -- the whole PoC is 14 bytes and the IFD it points at is the one already being parsed.
The dissector is reachable in the default configuration: directly, via the default-enabled wtap_file heuristic when a .tif is opened, and from ordinary captured traffic via the image/tiff media_type entry (e.g. an HTTP/WSP/MIME body). (CVE-2026-96418)
Toshiba captures are attacker-controlled text files processed after the handler recognizes the Toshiba banner and a packet marker. While searching for the packet OFFSET line, the parser reads into a fixed stack buffer with file_gets(), then forcibly truncates the current line at byte 16 and accepts it if the prefix equals "OFFSET 0001-0203". It then unconditionally parses the packet length from line+64. file_gets() only writes the bytes read plus one terminating NUL and does not clear the rest of the buffer, so a short line such as "OFFSET 0001-0203\n" leaves line[64] and following bytes containing stale/uninitialized stack contents from previous uses of the buffer. sscanf(line+64, ...) therefore reads data that is not part of the current input line, and if no NUL exists in the remaining stack-buffer region it may continue past the end of the stack object. A malicious capture can reach this path by providing a valid Toshiba header, a valid [No.] record header, and a short OFFSET-prefix line. This is an out-of-bounds/stale stack read in an untrusted file parser and can cause undefined behavior or a crash during file open/read. (CVE-2026-96420)
The USB HID dissector reconstructs a device's HID report descriptor from a GET DESCRIPTOR control-transfer response and parses it in parse_report_descriptor(). When the descriptor declares a Usage Minimum / Usage Maximum pair, the dissector expands the inclusive range into a wmem array with for (uint32_t j = usage_min; j <= usage_max; j++). Both bounds come straight from the capture, and HID "extended usage" items carry a full 4-byte usage value, so usage_max can be 0xFFFFFFFF. At that point j++ wraps 0xFFFFFFFF -> 0, the j <= usage_max test is unconditionally true, and the loop never terminates while appending 4 bytes per iteration to a file-scoped wmem array -- an infinite loop that also grows the heap without bound. (CVE-2026-96421)
A syntactically valid pcapng file containing many repeated packet-comment options can abort TShark when it builds the full protocol tree with -V. Wireshark renders every comment before entering the frame dissector's exception boundary. The normal one-million-tree-item safeguard consequently raises an uncaught DissectorError, terminating the process instead of reporting a bounded per-packet dissection error.
The Frame protocol metadissector could crash. (CVE-2026-96422)
The X11 dissector caches, per TCP conversation, one keysym array per keycode in x11_conv_data_t.keycodemap[256]. Each array is allocated in listOfKeysyms() with the keysyms-per-keycode width in force for the message being dissected, but the dissector records only a single scalar state->keysyms_per_keycode, with no per-array width. The X_ChangeKeyboardMapping request writes entries with a request-local width and leaves the scalar untouched; the X_GetKeyboardMapping reply sets the scalar. The two therefore diverge. When a later KeyPress/KeyRelease event is dissected, keycode2keysymString() indexes the cached arrays with the current scalar and never consults each array's real length, so any array allocated narrower than the scalar is read out of bounds. This is reachable from a capture with the default configuration (the X11 dissector is registered on TCP 6000-6063 and enabled by default; no protocol preference or key is required). (CVE-2026-96423)
Affected Packages:
wireshark
Issue Correction:
Run dnf update wireshark --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3252 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
wireshark-cli-debuginfo-4.6.9-1.amzn2023.0.2.aarch64
wireshark-cli-4.6.9-1.amzn2023.0.2.aarch64
wireshark-devel-4.6.9-1.amzn2023.0.2.aarch64
wireshark-debugsource-4.6.9-1.amzn2023.0.2.aarch64
src:
wireshark-4.6.9-1.amzn2023.0.2.src
x86_64:
wireshark-cli-debuginfo-4.6.9-1.amzn2023.0.2.x86_64
wireshark-devel-4.6.9-1.amzn2023.0.2.x86_64
wireshark-cli-4.6.9-1.amzn2023.0.2.x86_64
wireshark-debugsource-4.6.9-1.amzn2023.0.2.x86_64