CVE-2026-76889 in Wireshark
Summary
by MITRE • 08/20/2026
UMTS FP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Universal Mobile Telecommunications System (UMTS) Fast Packet (FP) protocol dissector, specifically affecting Wireshark versions ranging from 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This security issue manifests as a crash condition triggered by the processing of malformed or specially crafted network traffic that adheres to the UMTS FP protocol structure. The dissector, which is responsible for parsing and displaying packet data in human-readable formats during network analysis, fails to adequately validate input parameters before attempting memory operations. When an attacker sends packets containing invalid length fields, out-of-bounds offsets, or other structural anomalies within the FP header or payload sections, the application encounters a fatal error that results in immediate termination of the process. This behavior classifies the vulnerability as a denial of service (DoS) condition, where the availability of the network analysis tool is compromised without requiring authentication or prior interaction beyond receiving the malicious packet stream.
From a technical perspective, this flaw represents an improper input validation issue within the protocol parsing logic. The UMTS FP dissector likely attempts to access memory regions based on values extracted directly from the packet headers without sufficient boundary checks. In many such implementations, if a field indicating buffer size or offset is manipulated by an attacker to exceed allocated limits, it can lead to out-of-bounds reads or writes. While in this specific instance the primary observable impact is a crash rather than arbitrary code execution, the underlying mechanism remains dangerous as improper memory handling often serves as a precursor to more severe exploits such as remote code execution if additional conditions are met. The vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read, or potentially CWE-787, Out-of-bounds Write, depending on the exact nature of the memory access violation that triggers the crash. These weaknesses stem from a failure to enforce strict constraints on data structures derived from untrusted sources, highlighting gaps in defensive programming practices within the dissector codebase during this version range.
The operational impact of this vulnerability is significant for network administrators and security analysts who rely on Wireshark for real-time traffic analysis or forensic investigation involving UMTS networks. An attacker positioned to inject packets into a monitored segment can exploit this flaw to disrupt ongoing monitoring sessions, causing the analyst's workstation application to crash repeatedly. This not only interrupts workflow but also potentially leads to loss of unsaved capture data if auto-save features are not configured. In professional environments where continuous network visibility is critical for detecting other threats, such instability undermines trust in the toolset and creates windows of opportunity for adversaries who may be conducting reconnaissance or attack activities that go unnoticed due to the analyst's inability to maintain an active session. Furthermore, automated scanning tools targeting Wireshark instances could leverage this vulnerability to degrade service availability across multiple endpoints simultaneously if they are configured to parse UMTS traffic indiscriminately.
Mitigation strategies primarily involve upgrading to patched versions of Wireshark that address these specific parsing errors in the UMTS FP dissector. Users should ensure their software is updated beyond version 4.6.7 and 4.4.18, where developers have implemented stricter validation checks for header fields and payload boundaries. Until an upgrade can be performed, operators may consider disabling the UMTS FP protocol dissector within Wireshark preferences if they do not actively monitor such traffic, thereby preventing the code path containing the vulnerability from being executed during packet analysis. Additionally, deploying network segmentation to isolate sensitive monitoring infrastructure from untrusted or potentially hostile networks reduces the attack surface available for delivering malicious packets. Organizations should also implement strict filtering rules at the perimeter level to drop malformed UMTS frames before they reach internal analysis tools. This incident underscores the importance of rigorous input validation in protocol parsers and highlights the need for continuous security reviews of open-source network analysis utilities, particularly those handling complex telecommunications protocols like UMTS which have intricate header structures prone to edge-case exploitation.