CVE-2026-76881 Wireshark Foundation CVE debrief

Who should care

Wireshark users and administrators, network security teams, vulnerability management teams, and security operations teams should be aware of this vulnerability. Affected operators include those using Wireshark for network protocol analysis, platform administrators managing Wireshark installations, and security teams responsible for vulnerability management and incident response. This vulnerability may impact the security posture of organizations relying on Wireshark for network monitoring and analysis, potentially allowing attackers to disrupt network operations through denial-of-service attacks. Security teams should review Wireshark configurations, assess potential exposure, and plan for updates or mitigations as needed. Vulnerability management teams should prioritize patching or mitigating this vulnerability based on the CVSS score of 4.7 and medium severity. Security operations teams should monitor for potential exploitation attempts and be prepared to respond to incidents involving this vulnerability. Asset inventory management teams should ensure accurate tracking of Wireshark installations and their versions to facilitate prioritization of updates or mitigations. Rollback and change window management teams should be prepared to implement necessary changes to maintain security posture. Source tracking and monitoring teams should be aware of potential indicators of compromise and be prepared to respond to security incidents. Compensating controls, such as network segmentation or access controls, may be necessary for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Asset inventory and rollback/change window management processes should be updated to reflect the need for prioritized patching of this vulnerability. Source tracking and monitoring should be implemented to detect potential security incidents related to this vulnerability. The vulnerability's impact on security posture should be assessed, and necessary measures should be taken to maintain the security of Wireshark installations. Security teams should also review compens

Technical summary

The CMS protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 crashes due to improper handling of malformed CMS protocol data, allowing denial of service. CVSS score of 4.7 and medium severity. Wireshark users should be aware of potential impact on network security teams.

Defensive priority

Medium severity vulnerability in Wireshark's CMS protocol dissector, allowing denial of service. Update to fixed version.

Recommended defensive actions

• Update Wireshark to version 4.6.8 or later
• Update Wireshark to version 4.4.19 or later
• Restrict access to Wireshark's CMS protocol dissector

Evidence notes

The CVE-2026-76881 record confirms a vulnerability in Wireshark's CMS protocol dissector, allowing denial of service. Official CVE Program record and NVD vulnerability detail page confirm CMS protocol dissector crash vulnerability in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Limited source detail on affected scope and vendor remediation. Defenders should verify Wireshark version, review system logs for crash evidence, and assess potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.