Important: wireshark security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-96423: The X11 dissector caches, per TCP conversation, one keysym array per keycode in x11_conv_data_t.keycodemap[256]. Each array is allocated in listOfKeysyms() with the keysyms-per-keycode width in force for the message being dissected, but the dissector records only a single scalar state->keysyms_per_keycode, with no per-array width. The X_ChangeKeyboardMapping request writes entries with a request-local width and leaves the scalar untouched; the X_GetKeyboardMapping reply sets the scalar. The two therefore diverge. When a later KeyPress/KeyRelease event is dissected, keycode2keysymString() indexes the cached arrays with the current scalar and never consults each array's real length, so any array allocated narrower than the scalar is read out of bounds. This is reachable from a capture with the default configuration (the X11 dissector is registered on TCP 6000-6063 and enabled by default; no protocol preference or key is required). CVE-2026-96422: A syntactically valid pcapng file containing many repeated packet-comment options can abort TShark when it builds the full protocol tree with -V. Wireshark renders every comment before entering the frame dissector's exception boundary. The normal one-million-tree-item safeguard consequently raises an uncaught DissectorError, terminating the process instead of reporting a bounded per-packet dissection error. The Frame protocol metadissector could crash. CVE-2026-96421: The USB HID dissector reconstructs a device's HID report descriptor from a GET DESCRIPTOR control-transfer response and parses it in parse_report_descriptor(). When the descriptor declares a Usage Minimum / Usage Maximum pair, the dissector expands the inclusive range into a wmem array with for (uint32_t j = usage_min; j <= usage_max; j++). Both bounds come straight from the capture, and HID "extended usage" items carry a full 4-byte usage value, so usage_max can be 0xFFFFFFFF. At that point j++ wraps 0xFFFFFFFF -> 0, the j <= usage_max test is unconditionally true, and the loop never terminates while appending 4 bytes per iteration to a file-scoped wmem array -- an infinite loop that also grows the heap without bound. CVE-2026-96420: Toshiba captures are attacker-controlled text files processed after the handler recognizes the Toshiba banner and a packet marker. While searching for the packet OFFSET line, the parser reads into a fixed stack buffer with file_gets(), then forcibly truncates the current line at byte 16 and accepts it if the prefix equals "OFFSET 0001-0203". It then unconditionally parses the packet length from line+64. file_gets() only writes the bytes read plus one terminating NUL and does not clear the rest of the buffer, so a short line such as "OFFSET 0001-0203\n" leaves line[64] and following bytes containing stale/uninitialized stack contents from previous uses of the buffer. sscanf(line+64, ...) therefore reads data that is not part of the current input line, and if no NUL exists in the remaining stack-buffer region it may continue past the end of the stack object. A malicious capture can reach this path by providing a valid Toshiba header, a valid [No.] record header, and a short OFFSET-prefix line. This is an out-of-bounds/stale stack read in an untrusted file parser and can cause undefined behavior or a crash during file open/read. CVE-2026-96418: dissect_tiff() follows the TIFF Image File Directory (IFD) chain by repeatedly calling dissect_tiff_ifd() with the 32-bit "next IFD" offset it reads verbatim from the input. There is no visited-offset set, no requirement that the offset advance, and no iteration cap, so a TIFF whose IFD points its next-IFD field back at itself makes the walker loop over the same bytes forever. A bounds exception cannot rescue it, because the crafted offset is deliberately in bounds -- the whole PoC is 14 bytes and the IFD it points at is the one already being parsed. The dissector is reachable in the default configuration: directly, via the default-enabled wtap_file heuristic when a .tif is opened, and from ordinary captured traffic via the image/tiff media_type entry (e.g. an HTTP/WSP/MIME body). CVE-2026-96417: Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability CVE-2026-96416: It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. The IEEE 802.11 protocol dissector could crash. CVE-2026-96415: Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-95395: The SYNCHROPHASOR dissector (packet-synphasor.c) parses CFG3 configuration frames. The function config_3_frame_fast() reads the num_ph (number of phasors) field from the packet without any upper bound check, then allocates 17.8 MB of memory using wmem_file_scope() per frame. This memory is only freed when the capture file is closed, so sending multiple frames causes memory exhaustion and process termination. A single 78-byte UDP packet to port 4713 triggers a 17.8 MB allocation. 1000 frames (~200 KB on disk) cause ~17 GB of memory consumption, resulting in OOM kill or g_malloc abort. CVE-2026-95394: Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-95393: Heap buffer overflow (WRITE) in CSN.1 dissector -- CSN_RECURSIVE_ARRAY writes past destination array with no capacity check (packet-csn1.c). CVE-2026-95392: The MBIM protocol dissector could crash. Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. CVE-2026-95391: ZigBee ZCL Touchlink: empty the commissioning map on a redissect. Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file CVE-2026-95390: The PEAK TRC v1 ERROR-frame