CVE-2026-76924: 
Wireshark vulnerability analysis and mitigation

CVE-2026-76924 is a denial-of-service vulnerability in Wireshark's Kerberos protocol dissector that causes an application crash when processing malformed Kerberos packets. It affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The vulnerability was published on August 19, 2026, with a patch advisory released the following day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read), where the Kerberos protocol dissector reads data beyond the intended buffer boundary when parsing malformed Kerberos packets. Exploitation requires local access and user interaction — specifically, a user must open or process a crafted capture file or live capture containing a malformed Kerberos packet. The attack vector is local with low complexity and requires no privileges, but does require user interaction to trigger the dissector. The issue is tracked upstream in the Wireshark GitLab issue tracker (GitHub Advisory, Wireshark GitLab).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service to the analyst or user running the tool. There is no impact on confidentiality or integrity — the vulnerability is limited to availability of the Wireshark process itself. Because Wireshark is a network analysis tool rather than a network service, exploitation does not enable lateral movement or remote code execution, and the blast radius is confined to the local Wireshark instance (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Craft malformed Kerberos packet: Prepare a network capture file (e.g., .pcap or .pcapng) containing a specially crafted Kerberos protocol packet designed to trigger an out-of-bounds read in Wireshark's Kerberos dissector.
2. Deliver the capture file: Convince a target user running an affected version of Wireshark (4.6.0–4.6.7 or 4.4.0–4.4.18) to open the malicious capture file, or position the malformed packet in a live network capture session the user is monitoring.
3. Trigger dissector crash: When Wireshark attempts to parse the malformed Kerberos packet, the Kerberos dissector performs an out-of-bounds read, causing the application to crash and resulting in a denial of service (GitHub Advisory, Wireshark Advisory).

• Process: Unexpected termination or crash of the wireshark or tshark process, potentially with an associated crash dump or core file.
• File System: Presence of suspicious or externally sourced .pcap/.pcapng files containing Kerberos traffic delivered to analysts.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing Wireshark process termination; crash reports generated by Wireshark's built-in crash reporter.

Users should upgrade Wireshark to version 4.6.8 or later (for the 4.6.x branch) or 4.4.19 or later (for the 4.4.x branch) to remediate this vulnerability. As a workaround, administrators can restrict local access to systems running affected Wireshark versions and limit who is permitted to open untrusted capture files. Network segmentation to control who can capture or analyze Kerberos traffic with Wireshark also reduces exposure (Wireshark Advisory, GitHub Advisory).