Description

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T23:16:18.830Z",
  "pubdate": "2026-08-19T23:16:18.830Z",
  "executiveSummary": "A denial of service vulnerability exists within the RRC protocol dissector across specific software versions. The flaw allows an unauthenticated remote attacker to trigger a crash of the affected application or parsing engine by supplying a maliciously crafted protocol payload. The primary impact of this vulnerability is a complete denial of service, rendering the affected protocol analysis service unavailable and potentially destabilizing the host system running the vulnerable software component. The risk implications are severe for environments relying on continuous packet processing and network monitoring, as availability can be disrupted without requiring valid credentials or prior system access. Exploitation is typically achieved by injecting malformed RRC protocol packets into the network stream or input capture interface being processed by the vulnerable parser. Based on the provided description, the vulnerability stems from improper input validation or memory handling within the dissector logic when parsing specific protocol structures, leading to an abnormal program termination.",
  "technicalDetails": "The vulnerability resides in the RRC protocol dissector component utilized by the affected software versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.7. The root cause involves a failure in the packet parsing logic to safely handle malformed, unexpected, or maliciously crafted Radio Resource Control protocol fields, leading to conditions such as a null pointer dereference, buffer over-read, or assertion failure that triggers an unhandled exception and application crash.\nThe attack flow begins when an adversary transmits a specially crafted network packet containing malicious RRC payloads toward a system processing network traffic, or feeds the malformed capture file directly into the vulnerable application. Upon receipt, the parsing engine invokes the vulnerable RRC protocol dissector to decode the packet structure. As the dissector attempts to traverse the malformed nested fields or length indicators, it encounters anomalous data that violates expected schema constraints. Due to insufficient bounds checking and error handling within the dissector implementation, the execution flow encounters a fatal exception, abruptly terminating the host process.\nThe vulnerable component is explicitly the RRC protocol dissector module. Network exposure is present wherever the affected software parses untrusted network traffic or packet capture files. Authentication and privilege requirements are generally absent or minimal, as protocol dissectors typically process raw, incoming data streams prior to authentication boundaries. The payload behavior is strictly destructive to process availability, culminating in a denial of service condition without providing arbitrary code execution or privilege escalation capabilities based on the provided data."
}