CVE-2026-76882 in Wireshark
Summary
by MITRE • 08/20/2026
Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Bluetooth Attribute Protocol (BAP) dissector found in specific versions of network protocol analysis software, specifically affecting releases from version 4.6.0 through 4.6.7 and version 4.4.0 through 4.4.18. This security issue manifests as an application crash triggered by the processing of malformed or specially crafted Bluetooth packets during passive sniffing operations. The dissector is responsible for parsing and interpreting BAP data structures to present them in a human-readable format within the user interface. When the parser encounters unexpected input that deviates from the expected protocol structure, it fails to handle the error condition gracefully, leading directly to an unhandled exception or memory corruption event that terminates the application process abruptly.
From a technical perspective, this flaw represents a classic denial of service vector rooted in insufficient validation of incoming data streams before they are processed by the parsing engine. The Bluetooth Attribute Protocol is used for exchanging short segments of information between devices, and while it has specific constraints on packet size and structure, legacy or poorly implemented parsers may not strictly enforce these boundaries. In this instance, the dissector likely attempts to access memory locations based on offsets derived from untrusted input without verifying that those offsets fall within valid bounds. This lack of boundary checking allows an attacker who is in proximity to the target device to craft a malicious Bluetooth advertisement or connection packet containing malformed BAP data. Upon reception and subsequent parsing by the vulnerable software, this crafted payload causes the application to crash, effectively rendering it unusable until restarted.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. For security professionals using these tools for network analysis, incident response, or penetration testing, a sudden crash disrupts ongoing monitoring activities and can lead to loss of unsaved work if the application does not have robust auto-save features. In scenarios where continuous monitoring is required, such as in wireless intrusion detection systems that utilize similar parsing logic, this flaw could be exploited to blind security controls by repeatedly crashing the analysis engine. This creates a window of opportunity for attackers to perform unauthorized activities without triggering alerts or being detected by the compromised tooling infrastructure.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read, as well as CWE-400, Uncontrolled Resource Consumption, depending on whether the crash is caused by a memory access violation or excessive resource allocation during parsing attempts. In terms of the MITRE ATT&CK framework, this exploit technique falls under Tactic TA0004 Impact and specifically relates to techniques that disrupt service availability, such as Denial of Service via application crashes. It highlights the risk associated with third-party libraries or internal parsers that do not implement rigorous input sanitization routines for network protocols.
To mitigate this vulnerability, users must upgrade their software installation to a version later than 4.6.7 and 4.4.18 where these parsing errors have been corrected by implementing strict bounds checking on all incoming BAP data fields. Until an update is applied, operators should consider disabling the Bluetooth dissector within the application settings if it is not strictly required for their current workflow, thereby preventing the parser from being invoked against potentially malicious traffic. Additionally, deploying network segmentation to isolate sensitive analysis workstations from untrusted wireless environments can reduce the attack surface available to local attackers attempting to exploit this flaw through proximity-based attacks.