This vulnerability (CVE-2026-96418) in Wireshark Foundation's Wireshark product is due to a loop with an unreachable exit condition (CWE-835) in the TIFF protocol dissector. It affects Wireshark versions from 4.4.0 up to but not including 4.4.19 and from 4.6.0 up to but not including 4.6.9. The infinite loop can be triggered by specially crafted TIFF data, resulting in denial of service by causing the application to hang or crash. The CVSS v3.1 base score is 5.5 (medium severity), with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Successful exploitation causes denial of service by making Wireshark enter an infinite loop when dissecting TIFF protocol data. This results in application unavailability but does not affect confidentiality or integrity of data. No known exploits are reported in the wild.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted TIFF protocol data with affected Wireshark versions or upgrade to a version where this issue is resolved once announced.