CVE-2026-76926: 
Wireshark vulnerability analysis and mitigation

CVE-2026-76926 is a Denial of Service vulnerability in Wireshark's BUSMASTER file parser that causes an abnormal application exit when processing a crafted file. It affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17 (fixed in 4.6.8 and 4.4.18 respectively). The vulnerability was published on August 19, 2026, and has a CVSS v3.1 base score of 3.1 (Low) (GitHub Advisory, Wireshark Advisory).

The root cause is a Reachable Assertion (CWE-617), where the BUSMASTER file parser contains an assert() or similar statement that can be triggered by attacker-controlled input, causing the application to exit abnormally. Exploitation requires an attacker to craft a malicious BUSMASTER file and socially engineer a user into opening it within Wireshark; no authentication or elevated privileges are required, but user interaction is necessary. The attack vector is network-based with high complexity, reflecting the need to deliver the malicious file to the victim (GitHub Advisory, Wireshark GitLab).

Successful exploitation results in an abnormal exit (crash) of the Wireshark application, causing a temporary loss of availability for the affected user. The impact is limited to availability — there is no confidentiality or integrity impact — and the scope is unchanged, meaning only the Wireshark process itself is affected with no potential for lateral movement or data exfiltration (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (opening a malicious file), which further limits practical risk (GitHub Advisory).

1. Craft malicious file: Create a specially crafted BUSMASTER file designed to trigger the reachable assertion in Wireshark's BUSMASTER file parser.
2. Deliver the file: Distribute the malicious file to a target user via email attachment, file sharing, or a malicious download link.
3. Induce user interaction: Socially engineer the target into opening the crafted file with a vulnerable version of Wireshark (4.6.0–4.6.7 or 4.4.0–4.4.17).
4. Trigger crash: Upon parsing the file, the reachable assertion is triggered, causing Wireshark to exit abnormally and resulting in a denial of service for the user (GitHub Advisory, Wireshark Advisory).

• File System: Unexpected or unsolicited BUSMASTER-format files (e.g., .log, .blf, or other BUSMASTER-associated extensions) received from unknown or untrusted sources.
• Logs: Wireshark crash reports or application error logs indicating an assertion failure or abnormal exit during file parsing.
• Process: Wireshark process terminating unexpectedly shortly after opening a file, particularly without user-initiated closure.

Users should upgrade Wireshark to version 4.6.8 or later (for the 4.6.x branch) or 4.4.18 or later (for the 4.4.x branch) to remediate this vulnerability. As a workaround, users should avoid opening BUSMASTER files from untrusted or unknown sources. Organizations may also consider implementing application-level controls or file-type filtering to reduce exposure (Wireshark Advisory, GitHub Advisory).