Wireshark CVE-2026-76923

Exploitation requires the target to be running Wireshark in one of the affected version ranges (4.6.0-4.6.7 or 4.4.0-4.4.18) with the Bluetooth HFP dissector active, which is the default in standard Wireshark installations. User interaction is required (UI:R per CVSS): the victim must either open a crafted capture file locally or have Wireshark actively dissecting live Bluetooth HFP traffic when malformed frames are present. The local attack vector (AV:L) means the attacker cannot trigger the crash remotely without first placing a malicious file within the user's reach or being in the same Bluetooth capture environment. No authentication is required to open a capture file. Exploitation is limited by: the requirement for user-initiated file opening or active capture; the need to target a specific vulnerable version; and the ability to neutralize the attack surface entirely by disabling the HFP dissector in Wireshark preferences.

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects a constrained threat model: exploitation is local and requires user interaction, substantially limiting the attack surface compared to network-exploitable vulnerabilities. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV listing and the lack of identified public exploit code further support treating this as a lower-priority operational issue. The 'Information Disclosure' tag conflicts with the CVSS C:N metric - this should be verified against the vendor advisory at wnpa-sec-2026-79.html before assuming a pure DoS impact. Overall, this vulnerability poses genuine risk only to analysts actively using Wireshark to examine Bluetooth HFP traffic and is not a high-priority enterprise patching emergency absent targeted threat intelligence.

An attacker crafts a malformed Bluetooth HFP packet capture file (.pcapng or .pcap) embedding protocol fields with lengths that exceed allocated buffer boundaries, then delivers it to a target security analyst via email, file share, or download. When the analyst opens the file in a vulnerable Wireshark version, the HFP dissector's out-of-bounds read triggers an application crash, causing a denial of service. Alternatively, an attacker with proximity to a Bluetooth-monitored environment could inject malformed HFP frames into live traffic being captured by Wireshark. No public proof-of-concept has been identified at time of analysis.