Wireshark CVE-2026-76921

Exploitation requires the target user to actively open a specially crafted packet capture file (UI:R) or configure Wireshark to capture live traffic containing maliciously formed CMS messages - the CMS dissector must be enabled (its default state). The CVSS AV:L vector confirms the attacker cannot exploit this remotely without first delivering a malicious file to the victim host. No authentication is required to run Wireshark itself (PR:N), but the attacker must achieve file delivery through a separate means. Limiting factors: user interaction is mandatory; impact is strictly DoS (application crash, no code execution confirmed); the attack cannot escape the vulnerable system's scope (S:U); and the affected product is an analyst tool rather than a network-facing service, preventing unsolicited inbound exploitation.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects a constrained threat model: the attack vector is local (AV:L), requiring the target user to actively open or process a crafted capture file (UI:R), and impact is confined entirely to availability (A:H - application crash). There is no confidentiality or integrity impact, and scope is unscoped (S:U), meaning the crash cannot pivot to the underlying OS. No EPSS data was provided in the input; EPSS cannot be assessed. No KEV listing is present, and no POC exploit has been identified. Real-world priority is elevated for security operations teams and forensic analysts who routinely ingest externally sourced .pcap/.pcapng files from untrusted origins, and lower for users capturing only live local traffic. The use-after-free class does theoretically carry code-execution potential, but the CVSS A:H/C:N/I:N assessment and the DoS-only description do not support elevated impact claims without further vendor confirmation.

An attacker crafts a malicious .pcap or .pcapng capture file embedding specially formed CMS protocol messages designed to trigger the use-after-free condition in Wireshark's CMS dissector. The file is delivered to a network analyst - via email, shared storage, or a phishing-style download - who opens it in a vulnerable Wireshark version, causing the dissector to access freed memory and crash the application. No public exploit code has been identified at time of analysis; exploitation requires social engineering or file delivery to the victim.