Wireshark CVE-2026-76889

Exploitation requires the target to run a vulnerable Wireshark version (4.4.0-4.4.17 or 4.6.0-4.6.7) with the UMTS FP dissector enabled, which is the default configuration. A user must actively open a specially crafted capture file, or Wireshark must be performing a live capture on an interface receiving the malformed UMTS FP packet - either scenario satisfies the UI:R requirement. The high attack complexity (AC:H) means opportunistic, automated exploitation is unlikely; precise packet construction tuned to trigger the specific overflow is required. Exploitation is bounded to denial of service (process crash); no code execution or data exposure has been established from available data. The local attack vector (AV:L) means the attacker cannot deliver the payload directly over a network without user involvement - the victim must obtain and open the malicious capture file, or the attacker must be positioned to inject traffic into a live capture session.

The CVSS 3.1 base score of 4.7 (Medium) reflects a significantly constrained attack surface: AV:L mandates local or file-system-level access, AC:H reflects the precision required to craft a triggering payload, and UI:R requires the victim to actively open a malicious file or capture the malformed traffic. Impact is strictly limited to availability (A:H - process crash), with no confidentiality or integrity effect (C:N/I:N). EPSS data was not provided; given the local/interaction-required vector and absence of a CISA KEV listing, real-world exploitation risk is assessed as low. The moderate CVSS score is consistent with these constrained conditions - this is not a remotely exploitable, unauthenticated flaw. No SSVC data is available to further stratify operational priority. A minor version-range discrepancy exists between the CVE description (which lists 4.4.0-4.4.18 as vulnerable) and EUVD-2026-63145 (which specifies <4.4.18, implying 4.4.18 is the fix): analysts should treat the Wireshark vendor advisory at wnpa-sec-2026-66 as authoritative.

An attacker crafts a packet capture file (.pcap or .pcapng) containing a malformed UMTS FP frame engineered to trigger the heap buffer overflow in the dissector. The file is delivered to a network analyst via a shared drive, email attachment, or a malicious download, and when the analyst opens it in a vulnerable Wireshark version, the dissector crashes the application. No public exploit code has been identified at time of analysis, and the AC:H rating indicates crafting a reliable trigger requires non-trivial protocol knowledge.