CVE-2026-76921 in Wireshark
Summary
by MITRE • 08/20/2026
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Common Management Information Protocol (CMIP) dissector found in specific versions of network protocol analysis software, specifically releases ranging from version 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This issue manifests as an application crash triggered by malformed or specially crafted CMIP packets during the parsing process. The root cause lies in improper validation of input data within the dissector module, which fails to adequately check buffer boundaries or handle unexpected data structures before attempting memory operations. When a user opens a capture file containing these maliciously constructed packets or views live traffic with such anomalies, the software attempts to parse fields that do not conform to expected formats, leading to an out-of-bounds read or write operation. This results in immediate termination of the application process, effectively causing a denial of service for any analyst relying on the tool for network forensics or troubleshooting.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-Bounds Read, as well as potentially CWE-787, an out-of-bounds write depending on the specific memory corruption path triggered by the malformed packet structure. The vulnerability exploits the trust placed in input data during the decoding phase of network protocols. Dissectors are responsible for breaking down complex protocol headers and payloads into human-readable fields; however, when this process lacks rigorous sanity checks against buffer limits or array indices, attackers can craft packets that cause the parser to access memory locations outside its allocated space. This behavior is consistent with patterns observed in ATT&CK technique T1496, Resource Hijacking, specifically under the sub-technique of Denial of Service via application crash, although it primarily affects local availability rather than remote service disruption unless automated tools are involved.
The operational impact of this vulnerability extends beyond simple inconvenience for individual users. In enterprise environments where network monitoring and security analysis rely heavily on continuous operation of packet capture tools, a single malformed packet in a high-volume traffic stream can cause the dissector to crash repeatedly if processed automatically by scripts or scheduled analyses. This disrupts incident response workflows, delays threat detection efforts, and compromises the integrity of forensic investigations that depend on uninterrupted data collection. Furthermore, because CMIP is often used in telecommunications and industrial control systems for device management, an attacker with access to such networks could potentially exploit this flaw to degrade monitoring capabilities, creating blind spots during critical operations or maintenance windows.
Mitigation strategies primarily involve upgrading to patched versions of the software where these bounds checking mechanisms have been reinforced. Until an upgrade is feasible, users should exercise caution when opening capture files from untrusted sources and avoid processing live traffic containing unknown CMIP implementations without sandboxing the application environment. Additionally, implementing network segmentation to isolate critical management protocols like CMIP can reduce exposure to potential exploitation vectors originating from less secure zones within the infrastructure. Security teams should also configure their intrusion detection systems to flag anomalous CMIP packet structures that deviate significantly from standard protocol specifications, allowing for proactive blocking of potentially malicious traffic before it reaches vulnerable analysis tools.