Wireshark CVE-2026-76885

Exploitation requires the victim to be running Wireshark 4.6.0-4.6.7 or 4.4.0-4.4.18 with the Tektronix K12xx file parser active (the default in standard builds) and to manually open a specially crafted K12xx capture file - making user interaction (UI:R) an absolute prerequisite. The attack cannot be triggered passively or without the user's action. The high attack complexity (AC:H per the CVSS vector) further indicates that constructing a reliably triggering malicious file is non-trivial. Exploitation is bounded to an application crash: no code execution, privilege escalation, or data exposure is possible from this flaw. Users who never open K12xx-format files, or who have upgraded beyond the affected version ranges, are not at risk.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained blast radius: impact is limited to A:L (application crash), with no confidentiality or integrity consequences. The high attack complexity (AC:H) and mandatory user interaction (UI:R) materially reduce exploitability - opportunistic, mass-scale exploitation is implausible under these conditions. No EPSS score was provided in the input data; given the low severity and UI:R requirement, real-world exploitation probability is expected to be very low. This vulnerability does not appear in the CISA KEV catalog, and no public proof-of-concept has been identified. The primary realistic threat is targeted: an adversary would need to socially engineer a Wireshark user into opening a malicious K12xx file. For most security teams, this is a routine patch-cycle item rather than an emergency, though analysts who routinely process third-party K12xx capture files face the highest practical exposure.

An attacker crafts a malformed Tektronix K12xx-format capture file designed to trigger the buffer over-read in Wireshark's parser, then delivers it to a network engineer or security analyst via email, a shared file repository, or a bug-reporting channel. When the victim opens the file in an affected Wireshark version, the K12xx parser reads out of bounds and the application crashes. No public proof-of-concept exploit exists at time of analysis, and the AC:H rating suggests that reliably triggering the crash may require non-trivial familiarity with the K12xx file format.