PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76879 Wireshark Foundation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T23:16:18.700Z and has not been modified since then. The C12.22 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 is vulnerable to a crash due to improper handling of protocol data, potentially allowing for denial of service attacks. This issue emphasizes the need for network administrators and security teams to take immediate action. The vulnerability affects network administrators, security teams, and users of Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Evidence is based on official CVE and NVD records.

Vendor
Wireshark Foundation
Product
Wireshark
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-09-01
Advisory published
2026-08-19
Advisory updated
2026-09-01

Who should care

Network administrators, security teams, and users of Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 should be aware of this vulnerability and take necessary defensive actions to prevent potential denial of service attacks. This includes reviewing and applying vendor patches or updates to affected Wireshark versions, implementing network monitoring to detect potential exploitation attempts, and restricting access to C12.22 protocol dissector functionality where possible. Vulnerability management and security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The C12.22 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 is vulnerable to a crash due to improper handling of protocol data. This issue can lead to denial of service attacks, emphasizing the need for network administrators and security teams to take immediate action. The vulnerability has been addressed in later Wireshark versions, which include patches to prevent such crashes.

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS score of 7.5 and the potential for denial of service attacks.

Recommended defensive actions

  • Inventory and verify Wireshark installations to identify potentially vulnerable versions.
  • Apply vendor patches or updates to affected Wireshark versions.
  • Implement network monitoring to detect potential exploitation attempts.
  • Restrict access to C12.22 protocol dissector functionality where possible.

Evidence notes

The C12.22 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 is vulnerable to a crash, potentially allowing for denial of service attacks. Evidence is based on official CVE and NVD records. The vulnerability affects network administrators, security teams, and users of Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. To verify, defenders should review official advisories and assess their environment for potentially vulnerable Wireshark installations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-76879 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-76879

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-76879 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76879

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.