Wireshark CVE-2026-76927

The target must be running a vulnerable Wireshark version (4.6.0-4.6.7 or 4.4.0-4.4.17) and actively capturing or replaying traffic that contains H.245 protocol messages, which occur within H.323 multimedia conferencing sessions. The attacker must be able to inject or deliver crafted H.245 packets onto the network segment under observation, or trick an analyst into opening a malicious capture file containing H.245 data. Exploitation is constrained by the need for H.245 traffic to be present in the capture: environments that do not run H.323 conferencing infrastructure or whose analysts never capture such traffic are not exposed. The crash terminates only the Wireshark process; the underlying host OS, credentials, and captured data are not compromised.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects that no authentication or user interaction is required and the attack is delivered over the network, but several signals reduce real-world priority. EPSS probability is 0.10% at the 1st percentile, indicating negligible exploitation activity relative to other CVEs. SSVC classifies exploitation as 'none' and technical impact as 'partial', and the 'Automatable: no' designation partially conflicts with the CVSS AV:N/AC:L/PR:N/UI:N vector - this tension is best explained by the operational constraint that the attacker must know the target is running Wireshark and capturing H.245-bearing traffic, a condition that cannot be blindly automated at scale. Impact is bounded to crashing a monitoring or forensics tool; host OS integrity and data are unaffected. This is a genuine disruption risk for analysts actively capturing H.323 traffic, but not a broad organizational threat. Patch and patch-away is the correct posture rather than emergency remediation.

An attacker positioned on the same network segment as a Wireshark user capturing H.323 conferencing traffic sends a specially crafted H.245 control message into that traffic stream. When Wireshark automatically dissects the packet, the H.245 dissector dereferences a null pointer and crashes, abruptly terminating the capture session. No public proof-of-concept code has been identified at time of analysis.