Wireshark CVE-2026-76887

Exploitation requires that the victim is running an affected Wireshark version (4.4.0-4.4.17 or 4.6.0-4.6.7) AND actively opens a malicious packet capture file or performs live capture of network traffic containing the crafted malformed packet - passive exposure is insufficient. The CVSS UI:R metric explicitly confirms this user-interaction requirement. AC:H further limits exploitation to actors capable of crafting a precise heap-overflow-triggering payload; opportunistic or automated mass exploitation is unlikely. No authentication is required (PR:N) from the perspective of the attacker sending or embedding the packet. Exploitation is additionally bounded by impact: the result is exclusively a crash of the Wireshark process (A:L), not remote code execution or privilege escalation, as confirmed by C:N/I:N in the CVSS vector.

The CVSS 3.1 base score of 3.1 (Low), vectored as AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, reflects the genuine low priority of this vulnerability. The high attack complexity (AC:H) requires precise, non-trivial crafting of a malformed packet; the required user interaction (UI:R) means passive network exposure is insufficient - a victim must actively open a malicious capture file or perform live capture of attacker-controlled traffic. The impact is exclusively a low-severity availability loss (A:L): a crash of the Wireshark process with no data disclosure (C:N) and no integrity impact (I:N), ruling out code execution or privilege escalation. No CISA KEV listing confirms active exploitation, and no public exploit code has been identified from the provided data. EPSS data is absent from the source intelligence. Wireshark is a client-side tool rarely integrated into automated pipelines exposed to untrusted traffic, further constraining realistic exploitation scenarios. Security teams can treat this as a routine patch-cycle item, with elevated priority only for analysts who regularly ingest captures from untrusted or adversarial sources.

An attacker sharing a network segment with a Wireshark analyst, or who can deliver a malicious .pcap file to the analyst (via email, shared storage, or download), embeds a specially crafted malformed packet designed to trigger the heap-based buffer overflow in the dissection engine. When the analyst opens the file or performs live capture that includes the crafted packet, the relevant dissector overflows its heap buffer and Wireshark crashes. No public exploit code has been identified, and the AC:H rating indicates that reliably constructing the triggering packet is non-trivial.