CVE-2009-3550: The DCERPC/NT dissector in Wireshark 0.10.10 through 1.0.9 and 1.2.0 through 1.2.2 allows remote attackers...

Security readout for executives and security teams

CVE-2009-3550 is a Wireshark crash issue. A malformed packet-capture file can make vulnerable Wireshark versions stop working when the DCERPC/NT dissector processes it. This is mainly an availability risk for analysts and incident-response teams, not evidence of system compromise. Exposure is most likely where old Wireshark versions are still used to inspect untrusted packet-capture files. Internet-facing services are not described as directly vulnerable in the provided sources. Treat this as a hygiene and tooling-resilience issue. Prioritize remediation where old Wireshark is used in SOC, forensics, or incident-response workflows handling outside packet captures. Mitigation focus: Inventory Wireshark installations and flag versions 0.10.10 through 1.0.9 and 1.2.0 through 1.2.2.; Move affected installations to vendor-supported fixed releases, referencing Wireshark 1.0.10 and 1.2.3 guidance.; Avoid opening untrusted packet traces on vulnerable analyst workstations..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.