Wireshark CVE-2026-76920

Exploitation requires that a user running an affected Wireshark version (4.6.0-4.6.7 or 4.4.0-4.4.18) actively opens a crafted 3GPP phone log file - the 3GPP log file parser must be invoked, which only occurs when processing that specific file format. The high attack complexity (AC:H) suggests additional preconditions such as specific file structure or parser state. User interaction is mandatory (UI:R); the vulnerability cannot be triggered without the analyst choosing to open the malicious file. Exploitation is limited to denial of service against the local Wireshark process (S:U); no privilege escalation or remote code execution is implied by the available data. There is no network-facing attack surface - the flaw is entirely in offline file parsing.

The CVSS 4.7 score reflects the genuine constraints on this vulnerability: local attack vector (AV:L), high complexity (AC:H), and mandatory user interaction (UI:R) all reduce exploitability significantly. An attacker cannot exploit this remotely without first getting a victim to open a malicious 3GPP log file, making mass exploitation impractical. EPSS data was not provided in the input; given the local vector and the DoS-only impact, probabilistic exploitation scores are likely low. There is no CISA KEV listing and no public exploit code identified, which further depresses real-world urgency. The out-of-bounds write root cause (CWE-787) theoretically permits escalation to code execution, but the vendor advisory scopes impact to denial of service only - that claim should be verified independently. Overall, this is a patch-when-convenient issue for most organizations; prioritization upward is only warranted for environments where Wireshark analysts routinely ingest untrusted 3GPP capture files from external parties.

An attacker crafts a malformed 3GPP phone log file designed to trigger the out-of-bounds write in Wireshark's parser, then delivers it to a target analyst via email, shared network storage, or a compromised capture source. When the analyst opens the file in an affected Wireshark version, the parser crashes, terminating the session and any in-progress capture analysis. No public proof-of-concept exploit has been identified at time of analysis.