CVE-2026-76924

Out-of-bounds Read in Wireshark

View on CVE.org
Published Aug 19, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Analysis

AI-generated

Technical impact

The vulnerability is an out‑of‑bounds read in the Kerberos protocol dissector that causes Wireshark to crash. Reaching the crash results in a denial of service without compromising data confidentiality or integrity. The weakness is identified as CWE‑125, an input validation issue where the dissection code fails to verify packet bounds before reading data.

Affected Systems

Affected products are Wireshark by the Wireshark Foundation. The crash is triggered in Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Any installation of these releases will be susceptible to malfunction when processing malformed Kerberos packets.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via crafted network traffic that an attacker can send to a Wireshark instance to cause it to crash. The impact is localized to the Wireshark process, but for organizations that rely on real‑time packet capture, the crash could interrupt monitoring or forensic analysis.

Remediation

Vendor Solution

Upgrade to version 4.6.8 or above

OpenCVE Recommended Actions

  • Upgrade Wireshark to version 4.6.8 or newer to include the fix for the out‑of‑bounds read.
  • Disable the Kerberos dissector in Wireshark until a patch is applied, or filter incoming traffic to prevent malformed Kerberos packets from reaching the dissector.
  • Monitor for vendor updates or advisories that address the vulnerability in older releases.

Generated by OpenCVE AI on August 20, 2026 at 08:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6471-1 wireshark security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Wireshark
Wireshark wireshark
Vendors & Products Wireshark
Wireshark wireshark
Type Values Removed Values Added
Description Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Title Out-of-bounds Read in Wireshark
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitLab
Published
Updated
Sep 17, 2026, 6:48 PM
Reserved
Aug 19, 2026, 10:44 PM

View source JSON

Updated
Aug 20, 2026, 3:22 PM

JSON

Status
Analyzed
Published
Aug 19, 2026, 11:16 PM
Modified
Sep 1, 2026, 3:19 PM

View source JSON

Severity
Moderate
Public date
Aug 19, 2026, 10:45 PM

View source Bugzilla JSON

Updated
Aug 20, 2026, 8:45 AM

JSON