CVE-2026-76927: 
Wireshark vulnerability analysis and mitigation

CVE-2026-76927 is a NULL Pointer Dereference vulnerability in Wireshark's H.245 protocol dissector that allows a denial of service by crashing the application. It affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17 (fixed in 4.6.8 and 4.4.18 respectively). The vulnerability was published on August 19, 2026, and assigned a CVSS v3.1 base score of 4.7 (Medium) (Github Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring within Wireshark's H.245 protocol dissector component. An attacker can trigger the crash by supplying malformed H.245 protocol packets — either via a crafted packet capture file opened by a local user, or through live network traffic capture. Exploitation requires local access and user interaction (e.g., opening a malicious .pcap file), and the attack complexity is rated High, indicating specific conditions must be met to reliably trigger the crash (Github Advisory).

Successful exploitation causes the Wireshark application to crash, resulting in a denial of service for the affected user. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation. The scope is unchanged, meaning the crash is confined to the Wireshark process itself and does not affect other system components or enable lateral movement (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The local attack vector and high attack complexity further reduce the practical exploitability of this flaw (Github Advisory).

1. Craft a malicious capture file: Create a packet capture file (e.g., .pcap or .pcapng) containing malformed H.245 protocol packets designed to trigger a NULL pointer dereference in Wireshark's H.245 dissector.
2. Deliver the file: Distribute the malicious capture file to a target user via email, file share, or other means, relying on social engineering to convince the user to open it.
3. Trigger dissection: When the target opens the file in a vulnerable version of Wireshark (4.6.0–4.6.7 or 4.4.0–4.4.17), the H.245 dissector processes the malformed packets and dereferences a NULL pointer.
4. Application crash: Wireshark crashes, causing a denial of service for the user's packet analysis session (Github Advisory).

• File System: Unexpected or unsolicited .pcap / .pcapng files received from external sources, particularly those containing H.245 protocol traffic.
• Logs: Wireshark crash reports or core dump files generated after opening a packet capture file; application crash logs referencing the H.245 dissector.
• Process: Abrupt termination of the Wireshark process (wireshark, tshark, or dumpcap) without user-initiated closure, especially after opening a capture file from an untrusted source.

Users should update Wireshark to version 4.6.8 or later (for the 4.6.x branch) or 4.4.18 or later (for the 4.4.x branch) to remediate this vulnerability. As a workaround prior to patching, users should avoid opening packet capture files from untrusted or unknown sources, as these could contain malformed H.245 packets crafted to trigger the crash. The official security advisory is available at the Wireshark security page (Wireshark Advisory, Github Advisory).