Description

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T23:16:20.840Z",
  "pubdate": "2026-08-19T23:16:20.840Z",
  "executiveSummary": "A denial of service vulnerability exists within the CMS protocol dissector across specific software versions. The flaw resides in the protocol parsing logic, allowing an unauthenticated remote attacker to trigger a crash of the affected application by supplying a maliciously crafted packet or input stream. The impact of this vulnerability is strictly limited to availability, causing unexpected termination of the affected service or parser. The vulnerable products include versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Exploitation requires the ability to send network traffic or input processed by the vulnerable CMS protocol dissector, but does not inherently require prior authentication or elevated privileges. Risk implications are moderate to high depending on the deployment context, as recurring crashes can lead to prolonged service disruption and operational downtime.",
  "technicalDetails": "The vulnerability is rooted in a logic or memory handling defect within the CMS protocol dissector component responsible for parsing incoming protocol messages. When the parser encounters a malformed, unexpected, or boundary-violating structure within the CMS protocol payload, it fails to safely validate or handle the input. This improper input validation leads to a fatal runtime exception, such as a null pointer dereference, buffer over-read, or assertion failure, which subsequently forces the application process to crash.\nThe attack flow begins when an attacker transmits a specially crafted network packet or file containing malicious CMS protocol data toward a listening service or monitoring tool utilizing the vulnerable dissector. Upon reception, the affected component initiates the parsing routine to decode the protocol fields. As the parser processes the engineered payload, it encounters the invalid sequence or corrupted length indicators that bypass initial sanity checks. The resulting execution anomaly triggers an immediate application fault.\nThe vulnerable component is explicitly the CMS protocol dissector present in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Exploitation does not require authentication or specific privileges, as protocol dissectors typically process untrusted inputs directly from network interfaces or capture files. Network exposure depends on whether the service exposes the protocol parser to untrusted networks or if it processes arbitrary capture files provided by users. The payload behavior is designed solely to induce instability and crash the process rather than achieve remote code execution, resulting in a direct denial of service."
}