Wireshark CVE-2026-76880

Wireshark must be actively capturing live traffic from an interface where the attacker can inject packets, or must be processing a pcap file containing attacker-controlled RRC traffic - the RRC dissector is only invoked when RRC protocol messages are present. The attacker must be able to place a crafted RRC packet on the monitored network segment (AV:N per CVSS) but requires no authentication to Wireshark itself (PR:N). Exploitation is limited to crashing the Wireshark process; confidentiality and integrity are not impacted per the CVSS C:N/I:N metrics. Non-default configurations that disable the RRC dissector entirely would block this vector. The vulnerability does not affect Wireshark instances that are not capturing or replaying 4G/5G RRC traffic.

The CVSS 7.5 High score is justified for availability impact: the vector AV:N/AC:L/PR:N/UI:N means any attacker who can place a crafted packet on a network segment being captured requires no credentials and faces no complexity barrier. However, real-world risk is constrained by deployment context - Wireshark is typically a forensic and analysis tool run interactively by engineers, not an always-on production service; a crash is disruptive but rarely catastrophic. No EPSS score was provided and neither KEV status nor public exploit code has been identified at time of analysis, suggesting exploitation has not been observed in the wild. The CWE-787 classification warrants monitoring for escalation to code execution, but the described impact is DoS only. Organizations running automated Wireshark-based capture pipelines (e.g., continuous packet capture infrastructure for SOC monitoring) face higher operational risk than ad-hoc analyst workstations.

An attacker with the ability to transmit packets onto a network segment being monitored by a vulnerable Wireshark instance sends a specially crafted RRC protocol message. As Wireshark's RRC dissector attempts to parse the malformed message, it performs an out-of-bounds write that corrupts memory and crashes the Wireshark process. This terminates any active live capture session or halts automated pcap processing pipelines, denying analysts visibility into the monitored network.