Skip to main content

Wireshark CVE-2026-76928

| EUVDEUVD-2026-63166 HIGH
NULL Pointer Dereference (CWE-476)
2026-08-19 cve@gitlab.com GHSA-3qqr-q2w4-r5qh
Denial Of Service Null Pointer Dereference Wireshark
7.5
CVSS 3.1 · Vendor: gitlab
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain position to inject X.509IF traffic
  2. Delivery
    Craft malformed X.509IF packet
  3. Exploit
    Deliver packet into Wireshark capture stream
  4. Execution
    Trigger null pointer dereference in dissector
  5. Impact
    Crash Wireshark process

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target system must be running Wireshark 4.6.0-4.6.7 or 4.4.0-4.4.18 and actively capturing or processing a packet trace that contains X.509IF protocol traffic. The attacker must be able to introduce a malformed X.509IF packet into the monitored traffic stream, achievable via network-level injection, MITM positioning, or delivery of a crafted capture file for offline review. No authentication is required (PR:N per CVSS vector) and no user interaction beyond ordinary capture operation is needed (UI:N). Exploitation is strictly limited to denial of service via process crash; the CVSS vector explicitly excludes confidentiality (C:N) and integrity (I:N) impact. Systems not running the X.509IF dissector or not processing directory-service protocol traffic are not exposed.
Impact

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects the most permissive DoS profile: fully network-accessible, zero authentication, zero interaction, low complexity. However, real-world impact is bounded by Wireshark's deployment context - it is primarily a desktop analyst tool and tshark-based automation pipeline component, not a server daemon protecting core infrastructure, which limits blast radius compared to server-side vulnerabilities of equivalent CVSS. No EPSS score was provided in the input, preventing a probability-of-exploitation comparison. KEV status is absent, suggesting no confirmed widespread exploitation at the time of reporting. No POC availability data was included, so exploit maturity is unknown. The risk signals are internally consistent: a legitimate, easily triggerable crash against a widely deployed analyst tool, with impact confined to availability and no confidentiality or integrity consequences.
Exploit ScenarioDerived

An attacker positioned to inject packets into traffic being monitored by Wireshark - via the same network segment, a man-in-the-middle position, or by delivering a crafted .pcap file for offline analysis - sends a malformed X.509IF packet. When Wireshark's dissector processes the packet, the null pointer dereference triggers an immediate process crash, terminating the capture session. No public exploit code has been identified, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates reproduction requires only knowledge of the triggering packet structure.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 19, 2026

Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.

RemediationAI

Users should upgrade to the first patched release above the affected ranges in each branch - the version following 4.6.7 in the 4.6.x line or 4.4.18 in the 4.4.x line. Exact fix versions must be confirmed via the Wireshark security advisory at https://www.wireshark.org/security/wnpa-sec-2026-87.html, as specific patched release numbers are not confirmed in the available input data. As a compensating control where immediate upgrade is not feasible, analysts can suppress the X.509IF dissector in Wireshark by navigating to Analyze > Enabled Protocols and disabling X.509IF processing; this prevents the crash at the cost of losing visibility into legitimate X.509 directory traffic. Automated tshark-based capture pipelines should be monitored for unexpected termination and restarted promptly, and process supervision (systemd, supervisord) should be configured to auto-restart on crash to maintain monitoring continuity.

Affected VersionsENISA

Wireshark 4.4.0 <4.4.18
Wireshark 4.6.0 <4.6.8

Affected Packages

euvd wireshark fix: 4.4.18, 4.6.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Wireshark is the dominant open-source network protocol analyzer used by security teams, network engineers, and developers worldwide. The X.509IF dissector handles ASN.1-encoded X.509 Information Framework structures that appear in directory service protocols such as LDAP and X.500. CWE-476 (NULL Pointer Dereference) identifies the root cause: the dissector fails to validate a pointer before dereferencing it when processing malformed or unexpected X.509IF packet content, resulting in a process crash. Affected products are Wireshark cpe:2.3:a:wireshark:wireshark across the 4.4.x branch (4.4.0-4.4.18) and the 4.6.x branch (4.6.0-4.6.7). The bug is tracked upstream at https://gitlab.com/wireshark/wireshark/-/work_items/21469.

Know when Wireshark gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (gitlab) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Network-accessible crash with no authentication or interaction required; impact is solely process availability with no confidentiality or integrity consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Aug 20, 2026 - 01:01 EUVD
CVE Published
Aug 19, 2026 - 23:16 cve.org
HIGH 7.5

DescriptionCVE.org

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive ViewAI

Why It Matters

Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18 contain a critical denial-of-service vulnerability in the X.509IF protocol dissector that can be triggered remotely without authentication, potentially disrupting security monitoring and incident response operations. Any analyst or automated system using these versions to process network traffic faces risk of application crash and operational outage.

Business Impact: High
Compensating Controls

Until vendor patch is released: isolate Wireshark instances to trusted networks only, limit packet capture scope to known-safe traffic where possible, run Wireshark in sandboxed or ephemeral environments to minimize crash impact, and maintain detailed capture logs to detect exploitation attempts. Establish alerting for application restarts or capture failures in Wireshark processes. Consider temporary use of alternative packet analysis tools for critical monitoring until patches are validated and deployed.

Threat Intelligence Overview

EPSS Score
0.3%
Top 79% exploitable
Prevalence
High
dominant network analyzer tool, widely deployed by security and IT teams
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-76928 REF https://gitlab.com/wireshark/wireshark/-/work_items/21469 REF https://www.wireshark.org/security/wnpa-sec-2026-87.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy