Description

H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T23:16:21.447Z",
  "pubdate": "2026-08-19T23:16:21.447Z",
  "executiveSummary": "This vulnerability involves a denial of service condition stemming from a crash within the H.245 protocol dissector. The flaw allows remote threat actors to disrupt targeted network monitoring and analysis operations by triggering application faults.\nThe affected systems include software deployments utilizing the H.245 protocol dissector within version ranges 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Successful exploitation results in the immediate termination of the affected parsing process, leading to a complete denial of service for the inspection utility.\nThe risk implications are moderate to high for environments relying on continuous packet analysis, as unexpected process crashes impair visibility and monitoring capabilities. Attacker capabilities are constrained to causing a crash rather than executing arbitrary code, assuming standard memory corruption constraints without further input validation vectors.\nExploitation requirements typically involve the transmission of a malformed network packet containing specially crafted H.245 protocol data that is processed by the vulnerable dissector component. No authentication or elevated privileges are required if the vulnerable component parses untrusted network traffic directly.",
  "technicalDetails": "The vulnerability resides in the H.245 protocol dissector component responsible for parsing and interpreting H.245 control messages within network traffic streams. The root cause involves improper input validation or boundary handling when processing specific packet structures, leading to memory access violations, null pointer dereferences, or buffer management errors within the parsing logic.\nThe vulnerable component is explicitly present in versions 4.6.0 through 4.6.7 and versions 4.4.0 through 4.4.18 of the affected software. Network exposure is direct if the parsing engine ingests live, untrusted network traffic or processes packet capture files containing malicious payloads.\nThe attack flow proceeds as follows: First, an attacker crafts a malformed H.245 protocol data unit designed to violate the expected schema or structural constraints of the protocol specification. Second, the attacker transmits this payload across the network or embeds it within a capture file destined for analysis. Third, the vulnerable software receives the packet and invokes the H.245 protocol dissector to decode the payload. Fourth, as the dissector attempts to traverse the malicious fields or handle unexpected data lengths, it triggers a fatal runtime exception or segmentation fault.\nThe payload behavior focuses entirely on disrupting control flow and destabilizing the runtime environment of the parsing engine. Post-exploitation impact is limited to the immediate denial of service caused by the crash of the dissector or the parent application process, effectively halting traffic analysis and logging capabilities until manual or automated service recovery occurs."
}