Wireshark CVE-2026-76922

Exploitation requires that the victim is running an affected Wireshark version (4.6.0-4.6.7 or 4.4.0-4.4.18) and actively opens a packet capture file containing a specially crafted, malformed Bluetooth BR/EDR FHS packet - directly reflected in CVSS metrics AV:L (file/local-access vector) and UI:R (user interaction required). There is no remote unauthenticated exploitation path against a running Wireshark process; a social-engineering delivery step is mandatory. Impact is strictly scoped to crashing the Wireshark application (S:U, A:H): no OS-level privilege escalation, no code execution, no data exfiltration, and no persistence is possible through this vector alone.

The CVSS 3.1 score of 5.5 (Medium) accurately captures the constrained threat model: AV:L and UI:R together mean no remote exploitation path exists against a live Wireshark session - the attacker must first get the victim to open a crafted pcap file, a social-engineering dependency that significantly raises the practical bar. Impact is bounded to High availability (A:H) with C:N and I:N, meaning only the Wireshark process crashes; the host OS and any captured network traffic remain unaffected. No EPSS score was provided, and the absence of a CISA KEV listing is consistent with no confirmed active exploitation in the wild. No public proof-of-concept code was identified in the available intelligence. Overall this is a moderate-severity, low-urgency patch - even a small IT team should be able to address it in a routine patching cycle rather than treating it as an emergency.

An attacker crafts a Bluetooth BR/EDR capture file containing a malformed FHS packet and delivers it to a network analyst or security engineer via email attachment or a shared file repository. When the victim opens the file in an affected Wireshark version, the FHS dissector dereferences a null pointer and the application crashes, interrupting any in-progress analysis session. No public proof-of-concept code has been identified at time of analysis, so crafting the trigger payload requires knowledge of the specific FHS malformation that elicits the null dereference.