Description

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T23:16:18.947Z",
  "pubdate": "2026-08-19T23:16:18.947Z",
  "executiveSummary": "A denial of service vulnerability exists within the CMS protocol dissector across specific software versions. The flaw resides in the protocol parsing mechanism, specifically handling malformed or maliciously crafted CMS packets. When processing such inputs, the dissector triggers a crash, leading to an application-level denial of service affecting availability.\nThe affected products include version ranges 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The risk implication is significant for systems exposed to untrusted network traffic where continuous availability is critical, as a remote attacker can repeatedly trigger the parsing failure without requiring authentication or elevated privileges.\nExploitation requires the ability to transmit crafted network packets to the vulnerable system running the affected CMS protocol dissector. Successful exploitation results in the immediate termination of the target process or application, disrupting network analysis operations or dependent services.",
  "technicalDetails": "The vulnerability stems from inadequate input validation and error handling within the CMS protocol dissector component. When the dissector attempts to parse a malformed packet containing anomalous structures, unexpected state transitions, or corrupted length fields, internal assertions or memory management routines fail.\nThe vulnerable component is the CMS protocol parsing engine responsible for dissecting network payloads. Affected versions comprise 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The flaw is exposed over the network where the protocol parser processes incoming data streams.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious packet containing specially manipulated CMS protocol fields designed to violate parsing assumptions. Second, the attacker transmits this payload across the network to a target running the vulnerable software. Third, the CMS protocol dissector receives the packet and initiates the parsing routine. Fourth, upon encountering the anomalous data structures, the dissector fails to handle the parsing exception gracefully, resulting in a segmentation fault, null pointer dereference, or explicit assertion failure.\nThis behavior forces the host application to crash, achieving a denial of service condition. Authentication and privilege requirements are absent, as the parsing routines typically execute on raw or incoming untrusted network traffic before any session establishment or authorization checks occur. Payload behavior is focused entirely on destabilizing the parser rather than executing arbitrary code."
}