CVE-2024-2955

What it actually does

The T.38 dissector in Wireshark crashes when processing malformed protocol data in injected packets or crafted capture files, resulting in application termination.

Why it matters to the business

Security and network teams lose the ability to analyze traffic when analysts open malicious files, causing delays in investigations and potential gaps in monitoring.

How an attack unfolds

An attacker generates a capture file containing specially crafted T.38 data and delivers it to a target. Opening the file in an affected Wireshark version triggers the dissector crash and denial of service.

How to fix it

Upgrade Wireshark to a build containing commit c1fcda4ca0fbe25deb896243c5ec8dfaeedd3092 or 1fe5bce8d665c0d64e1af63545421c67596db165.

How to confirm the fix worked

Confirm the installed Wireshark build includes one of the listed fix commits, then test by attempting to open a capture file containing T.38 traffic.

Typical attack path

1. Create a capture file with malformed T.38 protocol data
2. Deliver the file to the target analyst or system
3. Victim opens the file in vulnerable Wireshark
4. Dissector processes the data and crashes the application

How to detect it

Review application crash logs and core dumps for references to the T.38 dissector; correlate sudden Wireshark terminations with recent opening of external capture files.

What your security team should do

• Apply the listed fix commits or newer Wireshark builds immediately
• Restrict opening of untrusted capture files until patched
• Subscribe to Wireshark release notifications for rapid updates