Wireshark CVE-2026-76926

Exploitation requires that the victim is running Wireshark version 4.6.0-4.6.7 or 4.4.0-4.4.18, and that the victim explicitly opens or imports a crafted BUSMASTER-format file (UI:R). High attack complexity (AC:H) indicates that producing a file that reliably triggers the specific assertion path is non-trivial. No authentication is required from the attacker's side (PR:N). Limiting factors: the attacker cannot exploit this remotely without victim interaction; crash impact is confined to the Wireshark process (S:U, A:L); and the BUSMASTER parser is only invoked when the user deliberately loads a BUSMASTER file, not during live capture of network traffic.

Real-world risk is low. The CVSS base score of 3.1 is consistent with the available signals: availability impact is rated Low (A:L) since only the user's Wireshark process crashes with no persistent data loss, and high attack complexity (AC:H) reflects the non-trivial requirement to craft a file that triggers the specific assertion path. EPSS data was not provided, but the combination of a low CVSS score, UI:R requirement, and absence from CISA KEV suggests exploitation probability is minimal. No POC has been identified at time of analysis. The vulnerability is a self-contained crash with no confidentiality or integrity impact, meaning a small IT team handling routine packet analysis has no urgency to treat this as critical - the patch should be applied on the next maintenance cycle rather than as an emergency.

An attacker crafts a malformed BUSMASTER capture file (.asc or .log) engineered to trigger the reachable assertion in Wireshark's parser, then delivers it to a target analyst - for example, as an email attachment or a shared file in an incident-response context. The analyst opens the file in an affected Wireshark build, causing an immediate abnormal process exit. The attack results in loss of the current capture session and any unsaved analysis, but no code execution or data exfiltration occurs.