CVE-2026-76929: 
Wireshark vulnerability analysis and mitigation

CVE-2026-76929 is a denial-of-service vulnerability in Wireshark's pcapng file parser caused by an out-of-bounds read (CWE-125). It affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17 (fixed in 4.6.8 and 4.4.18 respectively). The vulnerability was published on August 19, 2026, with a patch advisory released the same day. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Wireshark Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in Wireshark's pcapng file parser. When processing a specially crafted or malformed pcapng file, the parser reads data beyond the intended buffer boundary, triggering an application crash. Exploitation requires local access and user interaction — specifically, a user must open a malicious pcapng file — and the attack complexity is rated High, indicating that specific conditions must be met for successful exploitation (GitHub Advisory, Wireshark Advisory).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, and the scope is unchanged, meaning the vulnerability cannot be leveraged to affect other system components. An unauthenticated user can trigger the crash by inducing a target to open a malformed pcapng file, temporarily disabling Wireshark for the affected user (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for user interaction and high attack complexity further reduces the practical exploitability of this flaw (GitHub Advisory).

1. Craft malformed pcapng file: Create a specially crafted pcapng file designed to trigger an out-of-bounds read in Wireshark's pcapng parser — for example, by manipulating block lengths or option fields to cause the parser to read beyond allocated buffer boundaries.
2. Deliver the file to the target: Distribute the malicious pcapng file to a target user via email attachment, file share, or by hosting it on a website, relying on social engineering to prompt the user to open it.
3. Trigger the crash: When the target opens the malformed pcapng file in a vulnerable version of Wireshark (4.6.0–4.6.7 or 4.4.0–4.4.17), the parser performs an out-of-bounds read, causing the application to crash and resulting in denial of service (GitHub Advisory, Wireshark Advisory).

• File System: Presence of unexpected or unsolicited .pcapng files in user download directories, email attachments, or shared network folders.
• Logs: Wireshark crash reports or application error logs referencing pcapng parsing failures; operating system crash dump files (e.g., Windows Error Reporting .dmp files or Linux core dumps) generated by the Wireshark process.
• Process: Unexpected termination of the Wireshark process (wireshark.exe or wireshark) shortly after opening a pcapng file, particularly with access violation or segmentation fault signals.

Users should upgrade Wireshark to version 4.6.8 or later (for the 4.6.x branch) or 4.4.18 or later (for the 4.4.x branch) to remediate this vulnerability. As an interim workaround, avoid opening pcapng files from untrusted or unknown sources. Additionally, consider running Wireshark in a sandboxed environment when analyzing potentially malicious capture files (Wireshark Advisory, GitHub Advisory).