Description

UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T23:16:19.953Z",
  "pubdate": "2026-08-19T23:16:19.953Z",
  "executiveSummary": "This vulnerability involves a denial of service (DoS) condition residing within the UMTS FP protocol dissector of the affected software. Specifically, it allows a remote attacker to trigger an application crash, resulting in a denial of service for systems processing network traffic using the vulnerable protocol dissector.\nThe vulnerability type is a protocol dissector crash leading to denial of service. The affected systems include software versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The risk implication is significant for network monitoring and analysis operations, as an unexpected termination of the application disrupts availability and real-time packet inspection capabilities.\nThe attacker capabilities involve the ability to send specially crafted network packets or payloads containing malformed UMTS FP protocol data to the targeted system. Exploitation requirements rely on the vulnerable application processing network traffic or pcap files containing the malicious protocol structures, causing an unhandled exception, null pointer dereference, or memory corruption within the dissector logic.",
  "technicalDetails": "The vulnerability exists within the UMTS FP (Universal Mobile Telecommunications System Framing Protocol) dissector component responsible for parsing and interpreting network layer protocol data units. The root cause stems from improper input validation and insufficient boundary checks when processing specific fields within the UMTS FP headers or payloads.\nWhen the vulnerable component parses a malformed or maliciously crafted UMTS FP packet, it encounters unexpected data structures, invalid length specifiers, or corrupted state variables. This triggers a fatal runtime exception, assertion failure, or segmentation fault within the parsing routine, causing the entire parent application process to terminate abruptly.\nThe attack flow proceeds as follows: First, an attacker generates a malformed packet or data stream containing malicious UMTS FP protocol elements. Second, this payload is transmitted over the network interface monitored by the vulnerable software or introduced via a malicious packet capture (pcap) file loaded by an operator. Third, the application's packet ingestion engine routes the frame to the UMTS FP dissector for analysis. Fourth, upon encountering the invalid field values during traversal of the protocol hierarchy, the dissector fails to handle the exception gracefully. Finally, the resulting software crash halts all ongoing packet analysis and drops active monitoring sessions, achieving the denial of service objective.\nThe affected versions comprise software releases 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Authentication requirements, privilege requirements, and network exposure depend largely on the deployment context of the application, but successful exploitation typically requires the target to ingest network traffic or files controlled or influenced by the attacker. No post-exploitation persistence or remote code execution is indicated by the vulnerability characteristics; the primary impact is strictly limited to application availability and operational disruption."
}