Skip to main content

Wireshark CVE-2026-76886

| EUVDEUVD-2026-63142 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-08-19 GitLab GHSA-wrhv-64xq-9g54
Buffer Overflow Denial Of Service Heap Overflow Red Hat Wireshark Wireshark Foundation
Critical
Disputed · 9.8 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed C12.22 packet
  2. Delivery
    Deliver onto monitored segment or as .pcap
  3. Exploit
    Wireshark C12.22 dissector parses input
  4. Execution
    Heap buffer overflow (CWE-122)
  5. Impact
    Wireshark/tshark crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the victim runs a vulnerable Wireshark/tshark (4.4.0-4.4.17 or 4.6.0-4.6.7) with the C12.22 dissector enabled (it is enabled by default) and that the malicious C12.22 packet is processed - either by live-capturing attacker-influenced traffic or by opening a crafted capture file. Limiting factors: the attacker cannot trigger it unless the analyst actually captures/loads the crafted C12.22 packets, so it depends on the target being an active analyzer of that traffic; impact is confined to a crash (availability only), with no authentication bypass, code execution, or data disclosure demonstrated.
Impact

The signals conflict and must be reconciled before prioritization. The supplied CVSS 3.1 vector rates this 9.8 with C:H/I:H/A:H, but the description, the CWE tags (Denial Of Service / Buffer/Heap Overflow), and the reporter's framing all describe a dissector crash - a pure availability impact - so the C:H/I:H metrics appear overstated; a DoS-only reassessment is closer to 7.5 (A:H, C:N/I:N). SSVC supports a bounded view: Exploitation=poc (not active), Automatable=no, Technical Impact=total, meaning a reliable crash but not a wormable mass-exploitation primitive. EPSS is low at 0.27% (19th percentile), and the CVE is not in CISA KEV, consistent with no widespread exploitation. The practical exposure is also limited by who runs the C12.22 dissector - chiefly utility/AMI and ICS analysts - so even a mid-sized municipal utility operations team should patch promptly, but this is an operational-resilience issue for analysts rather than a server-side RCE emergency. Bottom line: real but moderate priority; do not treat the 9.8 as an RCE.
Exploit ScenarioDerived

An attacker who can inject or place crafted C12.22 traffic onto a network segment that a utility analyst is live-capturing (or who delivers a booby-trapped .pcap to that analyst) causes the C12.22 dissector to overflow a heap buffer and crash Wireshark/tshark. A proof-of-concept is indicated by the SSVC 'poc' status, so exploitation is realistic, but impact is limited to terminating the analysis session (denial of service), not code execution.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Aug 28, 2026

Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).

Earlier versions of this analysis (1)
v1 Aug 19, 2026 - 23:23 CVSS 8.1

Heap-based buffer overflow in Wireshark's C12.22 protocol dissector causes an application crash, enabling denial of service against analysts actively dissecting C12.22 traffic. Affected are Wireshark 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 (CPE: cpe:2.3:a:wireshark_foundation:wireshark:*:*:*:*:*:*:*:*), with vendor-released patches available as 4.4.18 and 4.6.8 per ENISA EUVD-2026-63142. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; however, the underlying CWE-122 class carries latent risk beyond DoS if the overflow proves reliably exploitable beyond a crash.

RemediationAI

Vendor-released patch: upgrade to Wireshark 4.4.18 or 4.6.8 (or later) per advisory wnpa-sec-2026-75 (https://www.wireshark.org/security/wnpa-sec-2026-75.html). If immediate upgrade is not possible, disable the C12.22 dissector via Analyze > Enabled Protocols (uncheck C12.22) so malformed packets are not parsed - the trade-off is loss of C12.22 decoding on that host. Additionally, avoid opening untrusted capture files and avoid live-capturing on untrusted segments with a vulnerable build, and prefer running dumpcap/capture under a low-privilege account to limit crash blast radius. These controls reduce exposure but do not remove the flaw; patching is the durable fix.

Affected VersionsENISA

Wireshark 4.4.0 <4.4.18
Wireshark 4.6.0 <4.6.8

Affected Packages

euvd wireshark fix: 4.4.18, 4.6.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Wireshark is a widely used network protocol analyzer that parses captured traffic through per-protocol 'dissectors'. The affected component is the C12.22 dissector, which decodes the ANSI C12.22 smart-metering/AMI transport protocol used in utility networks. The root cause is CWE-122, a heap-based buffer overflow: the dissector mishandles the length or structure of attacker-controlled C12.22 packet fields, writing past an allocated heap buffer during parsing and crashing the process. The single affected CPE is cpe:2.3:a:wireshark_foundation:wireshark, i.e., the Wireshark application itself (including tshark, which shares dissector code).

Know when Wireshark gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (GitLab) PRIMARY HIGH
NVD 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Crafted packet processed with no auth or interaction on live capture (AV:N/AC:L/PR:N/UI:N); impact is a crash only, so C:N/I:N/A:H, not the input's C:H/I:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Severity Changed
Aug 28, 2026 - 20:52 NVD
HIGH CRITICAL
CVSS changed
Aug 28, 2026 - 20:52 NVD
8.1 (HIGH) 9.8 (CRITICAL)
Patch available
Aug 19, 2026 - 23:04 EUVD
CVE Published
Aug 19, 2026 - 22:35 cve.org
HIGH 8.1

DescriptionNVD

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive ViewAI

Why It Matters

Wireshark versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contain a critical heap buffer overflow in the C12.22 protocol dissector that allows an attacker to crash the application via malformed packets. This denies security analysts the ability to inspect network traffic, potentially blinding threat detection capabilities during incident response.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 81% exploitable
Prevalence
High
Wireshark is a near-ubiquitous analyst tool; C12.22 dissector use is narrower
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-76886 ADVISORY https://vuldb.com/vuln/393586 REF https://gitlab.com/wireshark/wireshark/-/work_items/21439 REF https://gitlab.com/wireshark/wireshark/-/work_items/21446 REF https://www.wireshark.org/security/wnpa-sec-2026-75.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy