CVE-2026-76919 in Wireshark
Summary
by MITRE • 08/20/2026
ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the ESS (Extended Service Set) protocol dissector found in specific versions of network traffic analysis software, specifically ranging from version 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This security issue manifests as an application crash when processing malformed or unexpectedly structured data packets associated with the ESS protocol. The dissector is responsible for parsing and interpreting wireless network traffic, particularly within IEEE 802.11 environments where Extended Service Sets are used to connect multiple access points into a single logical network. When the software encounters packet structures that deviate from expected standards or contain corrupted fields, it fails to handle the input gracefully, leading to an immediate termination of the application process rather than logging an error and continuing operation.
From a technical perspective, this flaw represents a classic denial of service condition triggered by improper validation of input data. The root cause typically lies in insufficient bounds checking or null pointer dereferencing within the code responsible for parsing ESS information elements. An attacker who can inject crafted wireless frames into the network environment where the vulnerable software is running as an active sniffer or monitor can trigger this crash. This does not require authentication, meaning any device capable of transmitting 802.11 management or action frames with specific malformed payloads could exploit the weakness. The impact is immediate and disruptive to the continuity of network monitoring activities, which are critical for security operations centers and IT administrators relying on real-time visibility into wireless traffic patterns.
The operational impact of this vulnerability extends beyond a simple application restart. In environments where continuous packet capture is essential for threat detection or forensic analysis, an unexpected crash results in data loss during the window of unavailability. Furthermore, if the software is running as part of an automated monitoring system without robust watchdog mechanisms to automatically restart the service, the gap in visibility could allow malicious activities to go undetected. This aligns with CWE-400, which describes a resource exhaustion condition leading to denial of service, and specifically relates to improper input validation that causes application instability. In the context of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance disruption or potentially impacts availability as part of an infrastructure attack strategy by degrading the monitoring capabilities of defenders.
Mitigation strategies primarily involve upgrading the software to a patched version outside the affected ranges mentioned above. For organizations unable to immediately upgrade due to operational constraints, implementing network segmentation to limit exposure to untrusted wireless networks is advisable. Additionally, deploying intrusion detection systems that can identify and block malformed 802.11 frames before they reach the analysis endpoint provides an effective compensating control. Security teams should also ensure that their monitoring infrastructure includes redundancy measures such as automatic service restarts or failover mechanisms to minimize downtime in case of accidental crashes from other sources. Regular patch management cycles are essential to address these types of stability issues promptly, ensuring that security tools remain reliable and available for continuous operation.