CVE-2026-76887
published 2026-08-19CVE-2026-76887: Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
PriorityP425medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.18%
6.7th percentile
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | wireshark | — | — |
| wireshark | wireshark | — | — |
| wireshark | wireshark | >= 4.4.0 < 4.4.18 | 4.4.18 |
| wireshark | wireshark | >= 4.6.0 < 4.6.8 | 4.6.8 |
| wireshark_foundation | wireshark | >= 4.4.0 < 4.4.18 | 4.4.18 |
| wireshark_foundation | wireshark | >= 4.6.0 < 4.6.8 | 4.6.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
Heap-based Buffer Overflow in Wireshark
vendor_gitlab·2026-08-19·CVSS 3.1
CVE-2026-76887 [LOW] CWE-122 Heap-based Buffer Overflow in Wireshark
Heap-based Buffer Overflow in Wireshark
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Affected products: Wireshark
Affected versions: >=4.6.0, =4.4.0, <4.4.18 (affected)
Solution: Upgrade to version 4.6.8 or above
Credit: Daniel Birtwhistle
Red Hat
wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
vendor_redhat·2026-08-19·CVSS 3.1
CVE-2026-76887 [LOW] CWE-120 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
A flaw was found in Wireshark. This heap-based buffer overflow vulnerability in the dissection engine could allow a remote attacker to cause a denial of service. Exploitation requires a user to process a specially crafted network packet, leading to a crash of the application.
Statement: A flaw was found in the dissection engine in Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Red Hat Enterprise Linux 6, 7, 8, and 9 ship Wireshark versions prior to the affected range and are not vulnerable. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS ship an affected version of Wires
VulDB
Wireshark up to 4.4.18/4.6.7 Dissection Engine resource consumption
vuldb·2026-08-20·CVSS 3.1
CVE-2026-76887 [LOW] Wireshark up to 4.4.18/4.6.7 Dissection Engine resource consumption
A vulnerability, which was classified as problematic, has been found in Wireshark up to 4.4.18/4.6.7. Affected by this vulnerability is an unknown functionality of the component Dissection Engine. The manipulation leads to resource consumption.
This vulnerability is traded as CVE-2026-76887. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
ghsa_unreviewed·2026-08-20
CVE-2026-76887 [LOW] CWE-122 Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine [fedora-all]
bugzilla·2026-08-21·CVSS 3.1
CVE-2026-76887 [LOW] CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine [fedora-all]
CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Discussion:
Fixed in the current version of wireshark. Closing.
Bugzilla
CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
bugzilla·2026-08-19·CVSS 3.1
CVE-2026-76887 [LOW] CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
CVE-2026-76887 wireshark: Wireshark: Denial of service via heap-based buffer overflow in dissection engine
Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
2026-08-19
Published