CVE-2026-76879

Stack-based Buffer Overflow in Wireshark

Published Aug 19, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Analysis

Technical impact

Wireshark’s C12.22 protocol dissector contains a stack‑based buffer overflow that can be triggered when parsing certain malformed input, causing the application to crash. The vulnerability is classified as CWE‑121 and CWE‑617 and results in denial of service by terminating the Wireshark session.

Affected Systems

Wireshark Foundation’s Wireshark software is affected in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The vendor recommends upgrading to 4.6.8 or later to remove the flaw.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is 0.00279 (less than 1%), and the vulnerability is not listed in KEV. While the official description does not specify the attacker’s required environment, it is reasonable to infer that the exploit requires feeding a crafted capture file to the dissector, which suggests a local or user‑initiated attack vector rather than a remote network‑based one.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Wireshark Foundation

Wireshark

unaffected

Version	Status	Constraints
`4.6.0`	affected	< 4.6.8
`4.4.0`	affected	< 4.4.18

Configuration 1 [-]

OR	cpe:2.3:a:wireshark:wireshark::::::::
	cpe:2.3:a:wireshark:wireshark::::::::

No data.

Vendor Product Versions

Wireshark

Version	Status	Scheme	Platform
`[4.6.0,4.6.8)`	affected	semver	—
`[4.4.0,4.4.18)`	affected	semver	—

Remediation

Vendor Solution

Upgrade to version 4.6.8 or above

OpenCVE Recommended Actions

Upgrade Wireshark to version 4.6.8 or later
If an upgrade cannot be performed immediately, run Wireshark with the minimum privileges necessary and restrict the ability to load capture files to trusted users only
Monitor Wireshark logs and system performance for unexpected crashes and investigate any incidents promptly

Generated by OpenCVE AI on August 25, 2026 at 15:40 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6471-1	wireshark security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.312% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://gitlab.com/wireshark/wireshark/-/work_items/21480
https://nvd.nist.gov/vuln/detail/CVE-2026-76879
https://www.cve.org/CVERecord?id=CVE-2026-76879
https://www.wireshark.org/security/wnpa-sec-2026-89.html

History

Sep 17, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 1, 2026 3:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wireshark:wireshark::::::::

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://nvd.nist.gov/vuln/detail/CVE-2026-76879 https://www.cve.org/CVERecord?id=CVE-2026-76879
Metrics	threat_severity `None`	threat_severity `Important`

Aug 20, 2026 1:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wireshark Wireshark wireshark
Vendors & Products		Wireshark Wireshark wireshark

Aug 19, 2026 11:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Title		Stack-based Buffer Overflow in Wireshark
Weaknesses		CWE-121
References		https://gitlab.com/wireshark/wireshark/-/work_items/21480 https://www.wireshark.org/security/wnpa-sec-2026-89.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`