CVE-2026-76922 in Wireshark
Summary
by MITRE • 08/20/2026
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Bluetooth Baseband Radio Frequency Hardware (BR/EDR) Frame Header Specification protocol dissector, specifically affecting Wireshark versions ranging from 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This security issue manifests as a crash condition that results in a denial of service for the application running the packet analysis software. The root cause lies in improper input validation or boundary checking within the code responsible for parsing Bluetooth BR/EDR frame headers. When the dissector encounters malformed or unexpectedly structured data packets, it fails to handle edge cases correctly, leading to memory corruption or an unhandled exception that terminates the process abruptly. This type of vulnerability is characteristic of issues classified under CWE-125, which describes Out-of-Bounds Read, where the software reads data beyond allocated buffer boundaries due to insufficient validation of input parameters derived from network traffic.
From a technical perspective, Bluetooth BR/EDR communication relies on precise frame structures defined by the specification. The dissector in Wireshark is designed to decode these frames for analysis purposes. However, if an attacker can inject crafted Bluetooth packets containing malformed header fields or invalid length indicators into the capture stream, the parser may attempt to access memory locations that are not properly allocated or initialized. This leads to a segmentation fault or similar crash mechanism within the application process. The impact is primarily localized to the availability of the analysis tool itself rather than the underlying operating system or network infrastructure directly, although it can disrupt security monitoring workflows if analysts rely on continuous packet capture and real-time decoding for threat detection.
The operational impact of this vulnerability centers on service disruption for professionals using Wireshark for forensic investigation, protocol debugging, or security auditing. An attacker with the ability to transmit malicious Bluetooth BR/EDR frames within range could trigger a crash in any analyst viewing the traffic stream. This denial of service prevents the timely analysis of network events and can hinder incident response efforts during active attacks that utilize Bluetooth protocols. Furthermore, repeated crashes may lead to data loss if unsaved capture files are affected by the abrupt termination of the application process. The vulnerability highlights the risks associated with parsing complex binary protocols where strict adherence to specification rules is not enforced at every decoding step.
Mitigation strategies for this issue primarily involve updating the Wireshark installation to a version that includes patches addressing these specific input validation flaws in the Bluetooth BR/EDR dissector. Users should ensure they are running versions newer than 4.6.7 and 4.4.18, where the developers have implemented fixes to properly validate frame headers before processing them. In environments where immediate patching is not feasible, limiting exposure by disabling automatic decoding of suspicious or untrusted Bluetooth traffic streams can reduce risk. Additionally, employing network segmentation to isolate sensitive analysis workstations from potential sources of malicious Bluetooth signals provides an additional layer of defense against exploitation attempts targeting this specific application-level vulnerability.
This incident aligns with broader industry concerns regarding the robustness of protocol parsers in security tools. It underscores the importance of rigorous fuzzing and formal verification techniques during software development cycles to identify edge cases that could lead to crashes or memory safety violations. Security practitioners should remain vigilant for similar issues across other network dissectors within Wireshark, as they represent a common attack vector against analysis infrastructure. The ATT&CK framework does not directly map this specific application crash to a tactical technique in the same way it maps to exploitation of remote code execution vulnerabilities, but it relates to resource hijacking or disruption tactics where an adversary aims to degrade the capability of defensive tools through denial-of-service methods targeting software stability rather than system availability.