Wireshark CVE-2026-76924

Exploitation requires a user running an affected Wireshark version (4.4.0-4.4.18 or 4.6.0-4.6.7) to open a specially crafted packet capture file containing malformed Kerberos protocol data - the Kerberos dissector must be active (enabled by default) and the file must be parsed during the session. No authentication is required of the attacker (PR:N), but user interaction is mandatory (UI:R); the attacker cannot trigger the crash remotely without the victim actively opening the malicious file. Exploitation is bounded to systems where Wireshark is installed and users routinely process externally sourced or untrusted capture files. No live Kerberos server, active directory environment, or network connectivity is needed - only the dissector processing a crafted static file.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects a constrained threat model: AV:L means the attacker cannot trigger the crash over the network without the victim first saving and opening a crafted capture file, and UI:R further requires active user participation. EPSS data was not provided in the input, and this CVE is absent from the CISA KEV catalog, meaning no confirmed widespread exploitation exists. The impact is purely availability (A:H - process crash), with no confidentiality or integrity consequence per the CVSS vector, despite the 'Information Disclosure' tag in the metadata - a discrepancy that lowers confidence in the broader tag set. Wireshark is a desktop forensics tool rather than a network service, so the blast radius is limited to analyst workstations and not server infrastructure. Real-world prioritization should be moderate: patch during the next maintenance cycle, and enforce caution around opening untrusted capture files in the interim.

An attacker crafts a malformed Kerberos protocol packet capture file (.pcap or .pcapng) and delivers it to a network analyst via email attachment, a shared file repository, or a compromised packet capture source. When the analyst opens the file in an affected Wireshark version, the Kerberos dissector performs an out-of-bounds read and the application crashes, interrupting the analyst's workflow. No public exploit code has been identified at time of analysis, and the local/user-interaction attack vector makes unsolicited mass exploitation impractical.