Wireshark CVE-2026-76888

Wireshark must be actively running in live-capture mode on an interface that receives RDP traffic, or a user must open a capture file containing crafted RDP packets - the dissector only processes traffic when Wireshark is running and RDP dissection is enabled (which is the default configuration). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication to Wireshark is required and network delivery is sufficient; however, the attacker must be able to inject or route a malformed RDP packet into the traffic stream being captured. SSVC 'Automatable: no' limits mass exploitation: blindly scanning the internet will not trigger the vulnerability because the attacker must reach the specific capture interface of a running Wireshark instance. Impact is strictly limited to crashing Wireshark; no code execution, data exfiltration, or host-level availability impact is indicated.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, unauthenticated denial-of-service with no confidentiality or integrity impact. Real-world priority is substantially lower than the score implies: EPSS places this at the 7th percentile (0.17%), indicating that the overwhelming majority of CVEs with available data are considered more likely to be exploited. SSVC further qualifies exploitation as 'poc' (not active), 'automatable: no,' and 'technical impact: partial,' meaning mass-scanning campaigns are unlikely and impact is bounded to crashing a monitoring tool rather than compromising a production system. The absence from CISA KEV corroborates no confirmed active exploitation. The affected population is primarily security analysts and network engineers running Wireshark in capture mode - a disruption to their analysis session, not a server compromise. Patch availability from the vendor eliminates residual risk for any team that applies it promptly.

An attacker co-located on a network segment being monitored - or able to route crafted packets to the capture interface - transmits a malformed RDP packet. When Wireshark's RDP dissector processes the packet during live capture or when a saved capture file containing the packet is opened, the heap buffer overflow triggers a process crash, terminating the analyst's Wireshark session. A proof-of-concept exists per SSVC data, reducing the technical expertise threshold for triggering the crash.