CVE-2026-76880 in Wireshark
Summary
by MITRE • 08/20/2026
RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Radio Resource Control (RRC) protocol dissector, specifically affecting Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This issue manifests as an application crash when processing malformed or specially crafted RRC packets during network traffic analysis. The Radio Resource Control protocol is a core component of the Universal Mobile Telecommunications System (UMTS) and Long Term Evolution (LTE) air interface, responsible for establishing, maintaining, and releasing radio connections between user equipment and the cellular network. As such, it handles complex signaling messages that are essential for mobile connectivity management. When Wireshark attempts to parse these packets using its built-in dissector logic, a lack of proper bounds checking or input validation leads to an invalid memory access condition. This typically results in a segmentation fault or similar exception that terminates the application process abruptly, thereby preventing further analysis and disrupting any ongoing monitoring activities.
From a technical perspective, this flaw represents a classic denial-of-service vector rooted in improper handling of untrusted data within network protocol parsers. The dissector is designed to interpret binary structures defined by 3GPP standards, but it fails to adequately verify the integrity or length of specific fields before dereferencing pointers or allocating memory based on those values. An attacker who can inject malicious RRC packets into a monitored network segment could exploit this weakness remotely if they have access to the traffic capture interface or can redirect captured streams for analysis. The operational impact is primarily limited to availability, as the crash prevents security analysts and network engineers from utilizing Wireshark effectively during incident response or routine troubleshooting sessions involving cellular traffic. While the vulnerability does not directly compromise data confidentiality or integrity in this context, it undermines the reliability of critical diagnostic tools used by professionals who depend on stable packet analysis capabilities.
This type of vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read, as well as CWE-400 regarding Uncontrolled Resource Consumption if the crash leads to resource leaks or repeated attempts causing system strain. In terms of adversarial tactics, this scenario corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an adversary aims to disrupt access to or availability of computing resources by exploiting software vulnerabilities rather than overwhelming them with volume-based attacks. The exploitation requires the ability to influence the data being parsed, which may involve man-in-the-middle positioning on cellular networks or compromising a device that generates such traffic for testing purposes.
Mitigation strategies focus primarily on updating the affected software versions immediately. Users running Wireshark 4.6.x should upgrade to version 4.6.8 or later, while those on the legacy 4.4.x branch must update to at least version 4.4.19. These releases contain patches that implement stricter validation checks within the RRC dissector logic, ensuring that all field lengths and offsets are verified before processing occurs. Until an upgrade is feasible, administrators should consider isolating Wireshark instances from untrusted network segments or using alternative analysis tools for handling suspicious cellular traffic captures. Additionally, enabling core dump protection mechanisms on operating systems can help mitigate the immediate impact by preventing the crash from affecting other processes sharing the same memory space. Regular patch management and adherence to vendor security advisories remain essential practices for maintaining the integrity of network monitoring infrastructure against such parser-based vulnerabilities.