CVE-2026-76927 in Wireshark
Summary
by MITRE • 08/20/2026
H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical flaw within the H.245 protocol dissector found in specific versions of network analysis software, specifically ranging from version 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This security issue manifests as an application crash when processing malformed or specially crafted input data associated with the H.245 protocol. The H.245 control protocol is a key component of the ITU-T H.323 suite, which defines standards for multimedia communications over packet-based networks such as IP. It handles call signaling functions including capability exchange, logical channel opening and closing, flow control, and terminal identification. Because this protocol operates at the application layer, it is frequently encountered in VoIP (Voice over IP) and video conferencing traffic that security professionals often analyze using dissector tools within packet capture utilities like Wireshark or similar network analysis platforms.
The technical root cause of this vulnerability lies in improper validation or bounds checking during the parsing of H.245 messages by the software's dissectors. When a user opens a pcap file containing maliciously constructed packets, or when the tool is configured to actively capture and parse live traffic that includes these malformed structures, the dissector fails to handle unexpected data lengths, invalid field values, or corrupted ASN.1 DER encoding sequences correctly. This failure leads to an out-of-bounds memory access or a null pointer dereference within the application's execution context. The result is an immediate termination of the process, commonly known as a crash, which constitutes a denial of service condition for the user running the analysis tool. While this primarily affects the local machine where the software is executed rather than remote servers directly, it poses significant risks in environments where analysts routinely inspect untrusted network captures or debug complex VoIP deployments with potentially compromised endpoints.
From an operational perspective, the impact of this vulnerability extends beyond simple application instability. In professional cybersecurity and telecommunications engineering workflows, analysts frequently process traffic dumps from various sources that may not be fully trusted or verified for integrity. A crash in a primary analysis tool disrupts incident response activities, delays forensic investigations, and can lead to loss of unsaved work if the software lacks robust auto-save mechanisms. Furthermore, if an attacker can inject malformed H.245 packets into a network segment being monitored by such tools, they could effectively blind security monitoring systems or cause fatigue among analysts who must repeatedly restart their applications. This aligns with common vulnerability classifications related to input validation failures and resource management errors.
This issue is best categorized under CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer if the crash results from buffer overflow, or CWE-476 NULL Pointer Dereference if it stems from accessing uninitialized pointers due to malformed ASN.1 structures. In terms of attack vectors and tactics, this vulnerability relates to ATT&CK technique T1059 Command and Scripting Interpreter if exploited via scriptable interfaces, but more directly maps to disruption techniques where the goal is to degrade service availability rather than gain unauthorized access or execute code. It represents a classic denial-of-service vector targeting administrative tools used for network visibility.
Mitigation strategies primarily involve upgrading the affected software to patched versions that resolve these parsing errors. Users should ensure they are running version 4.6.8 or later, or version 4.4.19 and above, where the H.245 dissector has been hardened against malformed inputs. Until an upgrade is feasible, analysts can mitigate risk by avoiding the opening of untrusted pcap files in these specific versions or by using sandboxed environments to isolate potential crashes from their primary workstation. Additionally, configuring network monitoring tools to filter out H.245 traffic during initial triage phases can reduce exposure if live capture is necessary with vulnerable software. Organizations should also implement strict version control policies for security and analysis tools to ensure that known vulnerabilities are promptly addressed across all analyst workstations.