CVE-2026-9759

Vulnerability

The ROHC (Robust Header Compression) protocol dissector in Wireshark versions 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 contains a NULL-pointer write flaw. When processing a packet that uses the uncompressed profile (profile=0) with large_cid_present=true and the packet ends exactly at the CID field (len == val_len), wmem_alloc(pool, 0) returns NULL. A subsequent tvb_memcpy then writes one byte to address NULL, causing a crash [1]. The second tvb_memcpy uses len-1 cast to SIZE_MAX, which throws an exception, so only a single byte is written to NULL [1].

Exploitation

An attacker must first send a multi-packet sequence to establish the ROHC context with profile=0 and large CID enabled, typically via GTP-U or PPP transport [1]. After the context is set, the attacker sends a malformed packet whose ROHC payload ends exactly at the CID field length, triggering the vulnerable code path. The attack can be delivered by injecting a packet onto the wire or by convincing a user to open a malicious packet capture file [2]. No authentication or special privileges are required beyond network access or file delivery.

Impact

Successful exploitation causes a crash of the Wireshark application (denial of service). The write to NULL address corrupts memory and typically results in a segmentation fault. The attack does not appear to allow code execution or arbitrary memory write beyond the one-byte NULL write, and no exploits beyond crashing have been reported [2].

Mitigation

The vulnerability is fixed in Wireshark versions 4.6.6 and 4.4.16, released May 19, 2026 [2]. Users should upgrade to these or later versions. As a workaround, users can avoid opening untrusted packet captures and disable ROHC dissection via protocol preferences if not needed. No KEV listing or known public exploits exist as of publication [2].