Wireshark Foundation vulnerabilities and threats

A NULL pointer dereference vulnerability exists in the X.509IF protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The issue is identified as CWE-476 and has a CVSS v3.1 score of 7.5, indicating high severity.

CVE-2026-76927 is a medium severity vulnerability in Wireshark affecting versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. It involves a NULL pointer dereference in the H.245 protocol dissector that can cause the application to crash, resulting in a denial of service. The vulnerability requires local access with high attack complexity and user interaction. No confidentiality or integrity impact is reported.

CVE-2026-76926 is a reachable assertion vulnerability in the BUSMASTER file parser component of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to exit abnormally, resulting in a denial of service condition. The issue has a low severity rating with a CVSS score of 3.1. No known exploits are reported in the wild, and no official patch or remediation information is currently available.

CVE-2026-76889 is a heap-based buffer overflow vulnerability in the UMTS FP protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 4.7.

A heap-based buffer overflow vulnerability exists in the RDP protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a CVSS score of 3.1, indicating a medium severity level. There is no indication of confidentiality or integrity impact, only availability is affected. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

CVE-2026-76884 is a medium severity vulnerability in Wireshark affecting versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. It involves a buffer over-read in the ERF file parser that can cause the application to crash, resulting in a denial of service condition.

A heap-based buffer overflow vulnerability exists in the Catapult DCT2000 file parser of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.

CVE-2026-76882 is an out-of-bounds read vulnerability in the Bluetooth Attribute Protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity with a CVSS score of 4.7. No known exploits are reported in the wild, and no patch information is provided in the available data.

A NULL pointer dereference vulnerability exists in the CMS protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause the application to crash, resulting in a denial of service condition. The CVSS score is 4.7, indicating medium severity. No known exploits are reported in the wild. There is no explicit patch or remediation information provided in the input data.

CVE-2026-76924 is an out-of-bounds read vulnerability in the Kerberos protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5. No confirmed exploits are known in the wild. No patch or official fix information is provided in the available data.

CVE-2026-76923 is an out-of-bounds read vulnerability in the Bluetooth HFP Profile protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause Wireshark to crash, leading to a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5.

A NULL pointer dereference vulnerability exists in the Bluetooth BR/EDR FHS protocol dissector of Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.

A use-after-free vulnerability exists in the CMS protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause the application to crash, resulting in a denial of service condition. The issue has a medium severity rating with a CVSS score of 5.5. No information about available patches or exploits in the wild is provided.

CVE-2026-76920 is an out-of-bounds write vulnerability in the 3gpp phone log file parser of Wireshark versions 4.4.0 to 4.4.17 and 4.6.0 to 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 4.7.

A use of uninitialized variable vulnerability in the ESS protocol dissector of Wireshark versions 4.4.0 to 4.4.18 and 4.6.0 to 4.6.7 can cause the application to crash, resulting in a denial of service condition.

A heap-based buffer overflow vulnerability exists in the SSH protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The vulnerability has a medium severity rating with a CVSS score of 5.5. No known exploits are reported in the wild. Patch status is not confirmed in the provided data.

A heap-based buffer overflow vulnerability exists in the Bluetooth AVRCP Profile protocol dissector of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition.

CVE-2026-76891 is a medium severity vulnerability in Wireshark that causes a crash in the sharkd component due to expired pointer dereference. It affects Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. The issue leads to a denial of service condition but does not impact confidentiality or integrity.

CVE-2026-76890 is a medium severity vulnerability in Wireshark that causes a crash in the sharkd component due to expired pointer dereference. It affects versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. The issue results in a denial of service but does not impact confidentiality or integrity.

A buffer over-read vulnerability (CWE-126) exists in the Tektronix K12xx file parser of Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. This flaw can cause the application to crash, resulting in a denial of service condition. The vulnerability has a medium severity with a CVSS score of 3.1, requiring network access with high attack complexity and user interaction.