CVE-2026-76887 in Wireshark
Summary
by MITRE • 08/20/2026
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical stability issue within the packet disassembly engine of Wireshark, specifically affecting versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw manifests as an application crash when processing certain malformed or unexpectedly structured network packets. As a core component responsible for parsing raw data into human-readable formats, the dissection engine is exposed to untrusted input from various protocols during capture or file analysis operations. The root cause typically stems from insufficient bounds checking or improper handling of edge cases within specific protocol dissectors, leading to memory corruption such as buffer overflows or null pointer dereferences when the parser encounters anomalous data structures that deviate from expected standards.
From a technical perspective, this defect represents a classic denial-of-service vector where an attacker can exploit the lack of robust input validation in the parsing logic. When Wireshark attempts to dissect packets containing crafted fields with incorrect lengths, invalid offsets, or malformed protocol headers, the internal state machine may enter an undefined behavior path. This often results in segmentation faults or access violations that terminate the application process abruptly. The impact is particularly severe for security professionals and network administrators who rely on continuous monitoring tools, as a crash during live capture can lead to significant gaps in visibility into network traffic, potentially allowing malicious activities to go undetected due to the interruption of logging capabilities.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-125 Out-of-bounds Read and CWE-400 Uncontrolled Resource Consumption, depending on the specific memory access violation triggered by the malformed input. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1499 Endpoint Denial of Service, where an adversary aims to degrade or destroy the availability of a target system by exhausting its resources or causing it to crash through maliciously crafted inputs. The attack vector is primarily local if analyzing captured files but can be remote if Wireshark is configured to automatically process incoming traffic from untrusted sources without proper sanitization layers in place.
Mitigation strategies focus on immediate software updates and operational best practices. Users must upgrade to a patched version of Wireshark that resolves the specific dissection engine flaws, ensuring that all protocol parsers include rigorous validation checks before processing packet data. Additionally, organizations should implement network segmentation rules to restrict access to monitoring stations from untrusted networks and configure capture filters to exclude suspicious or malformed packets at the ingestion point rather than relying solely on post-capture analysis tools for protection. Regular auditing of Wireshark configurations against current security benchmarks is also recommended to maintain resilience against similar parsing-based vulnerabilities in future releases.