Wireshark sharkd CVE-2026-76890

Exploitation requires that the sharkd daemon is explicitly running and accessible over a network interface - sharkd is not started by default in standard Wireshark GUI or CLI installations and must be deliberately launched or deployed as a service. High attack complexity (AC:H) indicates that specific conditions beyond the attacker's direct control must be present, such as a particular internal daemon state or race condition. User interaction (UI:R) is required, suggesting that a user must perform an action - such as initiating a capture session or loading a file - to trigger the vulnerable code path. Exploitation is therefore limited to environments where sharkd is actively deployed as a network-accessible service and where an attacker can influence user actions or supply crafted input at the right moment. Standard desktop or CLI Wireshark installations that do not run sharkd are not affected.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) yields a score of 3.1, accurately reflecting low practical risk. High attack complexity (AC:H) means the attacker cannot reliably exploit this at will - specific conditions beyond their direct control must align. Required user interaction (UI:R) adds a further barrier. The sole impact is a low-availability crash of the sharkd daemon (A:L), with no confidentiality or integrity consequences. No EPSS score was supplied in the intelligence data, so numeric exploitation probability cannot be cited; however, the AC:H and UI:R constraints are consistent with an EPSS value that would be low. This vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified. The impact is confined to crashing the sharkd process - the underlying system is unaffected and sharkd can be restarted immediately, making even a successful exploitation transient. Remediation through a routine patch cycle is appropriate; emergency response is not warranted by the available signals.

An attacker with access to a network-exposed sharkd endpoint crafts a malformed API request or packet capture file designed to trigger the expired pointer dereference condition within the daemon. Delivering this input - potentially requiring coordination with a user action such as loading a capture - causes sharkd to crash, interrupting any active packet analysis sessions or API consumers relying on the daemon. No public proof-of-concept code has been identified, and the high attack complexity means reliable, repeatable exploitation would require precise engineering of the triggering conditions.