CVE-2026-96417: Wireshark RF4CE Parser Buffer Overflow — Detection, Isolation, and Patch Guidance

---
title: Wireshark Capture Opened From User-Controlled Location
tid: 9f7c1a2d-6b44-4d8e-a2c0-2d1f7e4a9b11
status: experimental
description: Detects Wireshark, TShark, Dumpcap, or related capture tools launched by browsers, mail clients, Office, archive utilities, or with capture files from Downloads, Temp, AppData, or email cache locations. Relevant to CVE-2026-96417 malicious capture delivery.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-747/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/21
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
      - '\mergecap.exe'
      - '\editcap.exe'
  selection_delivery:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\explorer.exe'
    CommandLine|contains:
      - 'downloads'
      - '\appdata\local\temp'
      - '\temporary internet files'
      - '\content.outlook'
      - '.pcap'
      - '.pcapng'
      - '.cap'
  condition: selection_tool and selection_delivery
falsepositives:
  - SOC analysts opening known captures from case folders; tune with approved case paths and analyst change windows.
level: medium
---
title: Wireshark Family Process Spawning Script Or Shell Child
tid: 6d0d9a4f-8a1c-4b7e-90a6-5d9f6b1c2e77
status: experimental
description: Detects cmd, PowerShell, WScript, CScript, rundll32, mshta, or unsigned executables launched as a child of Wireshark, TShark, Dumpcap, or related capture utilities. May indicate post-exploitation after parser compromise such as CVE-2026-96417.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-747/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/21
tags:
  - attack.execution
  - attack.t1059
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
      - '\mergecap.exe'
      - '\editcap.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare Wireshark extcap integrations; validate vendor-signed extcap plugins and approved analyst automation.
level: high
---
title: TShark Or Dumpcap Live Capture Outside Approved SOC Window
tid: 3c8e55f1-1d9a-4f61-b7a4-0d7e8c2a91b5
status: experimental
description: Detects TShark or Dumpcap starting live capture or reading capture input outside approved maintenance windows, with emphasis on capture arguments and non-admin user contexts. Useful for finding untrusted parsing pipelines exposed to CVE-2026-96417.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-747/
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2026/01/21
tags:
  - attack.collection
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\tshark.exe'
      - '\dumpcap.exe'
    CommandLine|contains:
      - ' -i '
      - ' -r '
      - '.pcap'
      - '.pcapng'
  filter_approved:
    CommandLine|contains:
      - 'approved_case_share'
      - 'managed_sensor_rollout'
  condition: selection and not filter_approved
falsepositives:
  - Legitimate packet capture troubleshooting; maintain an allowlist of capture servers, service accounts, and change tickets.
level: medium

let capture_tools = dynamic(['wireshark.exe','tshark.exe','dumpcap.exe','mergecap.exe','editcap.exe']);
let delivery_parents = dynamic(['chrome.exe','msedge.exe','firefox.exe','outlook.exe','winword.exe','excel.exe','powerpnt.exe','7z.exe','winrar.exe','explorer.exe']);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (capture_tools) or InitiatingProcessFileName in~ (capture_tools)
| extend Tool = iff(FileName in~ (capture_tools), FileName, InitiatingProcessFileName),
         ParentOrChild = iff(FileName in~ (capture_tools), InitiatingProcessFileName, FileName)
| where (FileName in~ (capture_tools) and (InitiatingProcessFileName in~ (delivery_parents)
        or ProcessCommandLine has_any ('.pcap','.pcapng','.cap')
        or ProcessCommandLine has_any ('Downloads','AppData\\Local\\Temp','Temporary Internet Files','Content.Outlook')))
     or (InitiatingProcessFileName in~ (capture_tools) and FileName in~ (dynamic(['cmd.exe','powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','wmic.exe'])))
| project TimeGenerated, DeviceName, AccountName, Tool, ParentOrChild, FileName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, SHA256, ReportId
| order by TimeGenerated desc;

-- Hunt for Wireshark-family parsing activity and recently delivered capture files.
-- Scope to analyst workstations, IR jump hosts, malware detonation hosts, and capture servers.
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(wireshark|tshark|dumpcap|mergecap|editcap)'
   OR CommandLine =~ '(?i)(\.pcap|\.pcapng|\.cap|Downloads|AppData\\Local\\Temp|Temporary Internet Files|Content\.Outlook)';

LET caps = SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/*.{pcap,pcapng,cap}',
  'C:/Users/*/AppData/Local/Temp/*.{pcap,pcapng,cap}',
  'C:/Windows/Temp/*.{pcap,pcapng,cap}'
])
WHERE Mtime > now() - 14*24*3600;

SELECT 'process' AS ArtifactType, Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime, NULL AS FullPath, NULL AS Mtime
FROM procs
UNION ALL
SELECT 'capture_file' AS ArtifactType, NULL, NULL, NULL, NULL, NULL, NULL, NULL, FullPath, Mtime
FROM caps;

#Requires -RunAsAdministrator
# Inventory Wireshark-family installs and flag hosts that need the CVE-2026-96417 fix verified.
# Set MinimumFixedVersion only from the official Wireshark advisory that lists CVE-2026-96417/ZDI-26-747 as fixed.
$MinimumFixedVersion = '0.0.0.0'  # Replace after vendor confirmation; leaving 0.0.0.0 forces verification.
$Output = Join-Path $env:ProgramData 'SecurityArsenal\Wireshark-CVE-2026-96417-Inventory.csv'
New-Item -ItemType Directory -Path (Split-Path $Output) -Force | Out-Null

$uninstallRoots = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$installed = foreach ($root in $uninstallRoots) {
  Get-ItemProperty $root -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Wireshark' -or $_.Publisher -match 'Wireshark' } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation, UninstallString, PSPath
}

$toolPaths = @(
  "$env:ProgramFiles\Wireshark",
  "$env:ProgramFiles (x86)\Wireshark",
  'C:\Program Files\Wireshark',
  'C:\Program Files (x86)\Wireshark'
) | Where-Object { Test-Path $_ }

$binaries = foreach ($p in $toolPaths) {
  Get-ChildItem $p -Include wireshark.exe,tshark.exe,dumpcap.exe,mergecap.exe,editcap.exe -Recurse -ErrorAction SilentlyContinue
}

$rows = foreach ($b in $binaries) {
  $v = $b.VersionInfo.ProductVersion
  $fixedKnown = ($MinimumFixedVersion -ne '0.0.0.0')
  $needsAction = $true
  if ($fixedKnown) {
    try { $needsAction = ([version]($v -replace '[^0-9\.].*$','') -lt [version]$MinimumFixedVersion) } catch { $needsAction = $true }
  }
  [pscustomobject]@{
    Host = $env:COMPUTERNAME
    Binary = $b.FullName
    ProductVersion = $v
    InstalledEntries = (($installed.DisplayName + ' ' + $installed.DisplayVersion) -join '; ')
    FixedVersionKnown = $fixedKnown
    MinimumFixedVersion = $MinimumFixedVersion
    NeedsPatchVerification = $needsAction
    Recommendation = 'Do not open untrusted captures; confirm fixed build via Wireshark advisory; isolate analyst capture workflows until verified.'
  }
}

$rows | Export-Csv -NoTypeInformation -Path $Output
Write-Host 'Inventory written to' $Output
Write-Host 'If FixedVersionKnown is False, patch verification is required before marking hosts compliant.'

# Risk reduction: add Mark-of-the-Web to capture files in common delivery folders so Explorer/Office handle them cautiously.
# This does not patch the parser and must not be used as a substitute for a fixed Wireshark build.
Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Include *.pcap,*.pcapng,*.cap -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object { try { Set-Content -Path $_.FullName -Stream Zone.Identifier -Value '[ZoneTransfer]`r`nZoneId=3' -ErrorAction Stop } catch {} }