CVE-2024-9781

What it actually does

Memory corruption in the AppleTalk and RELOAD Framing dissectors causes an immediate process crash when processing specially malformed packets or capture files.

Why it matters to the business

Network analysts lose the ability to inspect traffic with Wireshark until the application is restarted, disrupting troubleshooting and incident response workflows; the affected packages appear in container and orchestration ecosystems, amplifying exposure across developer and operations environments.

How an attack unfolds

An attacker crafts a malicious pcap or injects malformed packets containing AppleTalk or RELOAD Framing data; when Wireshark opens the file or processes the live traffic the dissector triggers the memory corruption and the application terminates, achieving denial of service.

How to fix it

Upgrade Wireshark to the commit 575b2bf4746e29e35a99e50fbec0de9fcaa1155a or later releases that contain the fix; update github.com/moby/moby and github.com/docker/docker to version 24.0.9+incompatible or newer where these components are present.

How to confirm the fix worked

Confirm the installed Wireshark binary reports a version containing commit 575b2bf4746e29e35a99e50fbec0de9fcaa1155a; attempt to open a known-bad capture file and verify the application no longer crashes.

Typical attack path

1. Obtain or generate a capture file containing malformed AppleTalk or RELOAD Framing frames
2. Deliver the file to a target analyst or trigger live capture on an interface receiving the crafted traffic
3. Wireshark loads the frames and invokes the vulnerable dissector
4. Memory corruption occurs and the application crashes

How to detect it

Review application crash logs and core dumps on analyst workstations for sudden Wireshark terminations while processing capture files; correlate with file-open events involving unknown or external pcaps.

What your security team should do

• Immediately update all Wireshark installations to the fixed commit or newer release
• Replace any bundled or containerized instances of moby/docker with the patched 24.0.9+incompatible versions
• Add Wireshark version checks to software inventory and CI pipelines
• Monitor for future Wireshark updates given the history of dissector vulnerabilities