Wireshark sharkd CVE-2026-76891

Exploitation requires that the target system is running sharkd (Wireshark's daemon mode), which is not enabled by default in standard desktop Wireshark installations - it must be explicitly invoked or configured as a service. The CVSS vector specifies High attack complexity (AC:H), meaning the attacker must construct input that precisely triggers the expired-pointer code path, which limits reliable exploitation. User interaction (UI:R) is also required, meaning an active sharkd session must be in progress or a user/process must initiate packet analysis against the malicious input. Exploitation is further limited to denial of service only - no code execution, data exposure, or integrity impact is possible. Environments where sharkd is not deployed are not affected at all.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L yields a base score of 3.1 (Low), which accurately characterises the constrained risk. High attack complexity (AC:H) means reliable exploitation requires precise conditions - likely a specially crafted capture file or packet stream that triggers the specific expired-pointer code path. User interaction (UI:R) is required, meaning a sharkd session must be actively initiated. The impact is bounded to availability (A:L, limited), with no confidentiality or integrity consequences and no scope change. EPSS data was not provided; given the low CVSS score, niche sharkd deployment, and absence of KEV listing or public exploit, real-world prioritisation should be low for most organisations. Environments that expose sharkd as a network service to untrusted input face the highest relative risk.

An attacker delivers a maliciously crafted packet capture file or specially structured JSON-RPC request to a sharkd instance accessible over the network. When a user or automated frontend initiates an analysis session that processes the crafted input, the expired pointer dereference is triggered, causing sharkd to crash and interrupting any ongoing packet analysis. No public exploit code has been identified at time of analysis.