Description

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T23:16:19.553Z",
  "pubdate": "2026-08-19T23:16:19.553Z",
  "executiveSummary": "A denial of service vulnerability exists within the C12.22 protocol dissector across multiple software versions. The flaw allows remote attackers to cause application crashes by exploiting parsing deficiencies in the handling of malformed or maliciously crafted protocol traffic.\nThe vulnerability directly impacts availability, as an unexpected crash terminates the parsing process, potentially leading to service disruption in environments processing untrusted network streams. The affected products encompass versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18.\nNo specific authentication or high-privilege capabilities are inherently required to trigger the dissector if the vulnerable component is exposed to untrusted packet captures or live network data streams. Exploitation relies on the ability to inject or supply specifically formatted C12.22 protocol data into the parsing engine, resulting in an unhandled exception or memory corruption error that forces the host process to terminate.",
  "technicalDetails": "The vulnerability resides in the C12.22 protocol dissector component responsible for parsing and interpreting ANSI C12.22 networking data structures. The root cause stems from insufficient bounds checking, improper input validation, or flawed state machine logic when decoding specific packet fields within the dissector implementation.\nWhen the vulnerable component processes a maliciously crafted C12.22 packet payload, the parsing routine encounters unexpected data lengths, invalid nested structures, or malformed type-length-value elements that fail to conform to the expected protocol specification. Because the input validation logic fails to safely handle these anomalies, the code may trigger a null pointer dereference, buffer overflow, or an out-of-bounds memory access.\nThe attack flow typically proceeds as follows: First, the adversary constructs a specially crafted network packet or capture file containing malicious C12.22 protocol sequences. Second, the target system ingests this data, routing it to the C12.22 dissector for analysis. Third, as the dissector attempts to unpack the malicious fields, the parsing logic faults due to the absence of robust error handling.\nThis execution path immediately triggers a fatal runtime exception, crashing the parent application or processing daemon. The affected versions include 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Network exposure depends on whether the vulnerable dissector is actively processing live network interfaces or parsing untrusted user-supplied capture files. Post-exploitation impact is strictly limited to denial of service through application termination, with no inherent remote code execution or privilege escalation vectors described."
}