CVE-2026-76923 in Wireshark
Summary
by MITRE • 08/20/2026
Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the Bluetooth Hands-Free Profile (HFP) protocol dissector, specifically affecting Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This security issue manifests as an application crash triggered by malformed or specially crafted Bluetooth HCP data packets during the process of network traffic analysis. The Hands-Free Profile is a standard protocol used to enable communication between mobile phones and hands-free devices, such as car kits or headsets, facilitating voice calls and audio streaming. When Wireshark attempts to dissect these specific packet structures, it encounters an unexpected condition that leads to a segmentation fault or similar memory corruption error, resulting in the immediate termination of the application process.
From a technical perspective, this vulnerability is classified under CWE-125, which denotes Out-of-bounds Read, and potentially CWE-400, indicating Uncontrolled Resource Consumption if the crash results from excessive resource allocation during parsing. The root cause lies in insufficient validation checks within the protocol dissector code before accessing memory buffers associated with HFP frame fields. An attacker who can inject or manipulate Bluetooth traffic directed at a system running the affected Wireshark version could exploit this flaw to trigger the crash remotely if they are within radio range, or locally by providing malicious capture files for analysis. The lack of bounds checking allows the dissector to read beyond allocated memory boundaries, corrupting the stack or heap and causing the application to abort execution to prevent further system instability.
The operational impact of this vulnerability is primarily a denial of service against the analyst using Wireshark rather than the underlying operating system or network infrastructure itself. For security professionals relying on Wireshark for incident response, forensic analysis, or protocol debugging, an unexpected crash can lead to significant data loss if unsaved capture files are involved. Furthermore, it disrupts ongoing monitoring activities and requires manual intervention to restart the application, potentially delaying critical investigations. While this does not typically allow remote code execution directly through the dissector alone, the instability poses a risk in environments where Wireshark is used for automated packet processing or integrated into larger security orchestration platforms that expect stable output from network analysis tools.
Mitigation strategies focus on updating to patched versions of Wireshark that include fixes for this specific HFP parsing logic. Users should ensure they are running version 4.6.8 or later, or version 4.4.19 and above, where the memory access checks have been hardened. In scenarios where immediate patching is not feasible, analysts can mitigate risk by avoiding the analysis of untrusted Bluetooth capture files containing HFP traffic until an update is applied. Additionally, running Wireshark in a sandboxed environment or using virtual machines with snapshot capabilities can limit the blast radius if accidental exposure to malicious captures occurs. Regularly updating protocol dissectors and staying informed through vendor security advisories remains essential for maintaining robust network analysis practices against evolving threats targeting open-source intelligence gathering tools.