Wireshark CVE-2026-76882

Exploitation requires the victim to be running an affected Wireshark version (4.4.0-4.4.17 or 4.6.0-4.6.7) and to actively open a PCAP file containing crafted Bluetooth Attribute Protocol packets, or to initiate a live Bluetooth capture session during which such packets appear - both requiring explicit user interaction (UI:R). The Bluetooth ATT dissector must be enabled, which is its default state. The attack vector is strictly local (AV:L): the malicious capture must reach the analyst's local filesystem or Bluetooth interface; there is no remote network-facing exploitation path. High attack complexity (AC:H) limits reliable exploitation to adversaries with specific knowledge of the malformed packet structure. Exploitation impact is bounded to terminating the Wireshark process and does not affect the host OS, other processes, or network infrastructure.

The CVSS 3.1 base score of 4.7 (Medium) accurately reflects several compounding risk-limiting factors: local attack vector (AV:L) means the malicious input must reach the analyst's own machine rather than being delivered over a network service; high attack complexity (AC:H) requires specifically structured malformed ATT content; user interaction (UI:R) demands the victim actively open or process the hostile input; and scope is unchanged (S:U), confining impact to the Wireshark process alone. No EPSS score was supplied in the available intelligence, and the absence of a CISA KEV listing combined with no confirmed public proof-of-concept means exploitation likelihood is assessed as low. Impact is bounded to crashing Wireshark - no privilege escalation, no code execution, no OS-level effect. The 'Information Disclosure' tag in the source data conflicts with the CVE description limiting confirmed impact to DoS; this discrepancy should be verified against the vendor advisory before treating memory-leakage as a confirmed risk. Security teams should treat this as a standard patch-cycle item rather than an emergency response trigger.

An attacker crafts a PCAP file containing a malformed Bluetooth Attribute Protocol packet designed to trigger the out-of-bounds read, then delivers it to a network analyst via email or shared storage, or generates the malicious traffic on a shared Bluetooth-accessible network segment. When the analyst opens the file or the live capture in an unpatched Wireshark instance, the ATT dissector reads beyond its buffer boundary and crashes the application. No public proof-of-concept exists, and the high attack complexity requirement means the attacker must know the specific malformed packet structure needed to reliably trigger the fault.