CVE-2026-76923 Wireshark Foundation CVE debrief

Who should care

Network administrators and security teams responsible for Wireshark installations, particularly those using Bluetooth HFP Profile protocol dissector, should be aware of this vulnerability. They should verify their installations and take necessary actions to mitigate potential risks. Additionally, security teams should monitor for potential denial of service attempts via Bluetooth HFP Profile protocol dissector and review compensating controls for exposed systems while remediation is scheduled and verified. This includes reviewing relevant monitoring, detection, and logs for exposed assets that need extra review. Operators of affected platforms and those responsible for vulnerability management within their organizations should prioritize assessment and remediation efforts based on their specific exposure and risk profile. Security teams should also consider the potential operational impact of this vulnerability on their managed environments and assign owners for follow-up actions as necessary. This may involve coordinating with vendors for patches or implementing compensating controls where patches are not immediately available. The Bluetooth HFP Profile protocol dissector's crash could have varying impacts depending on the specific use cases and configurations within an organization, emphasizing the need for a thorough review of affected systems and potential impacts on network operations. Given the medium severity of this vulnerability, prioritizing its remediation within the broader context of organizational risk management is advisable. This involves balancing the need for timely mitigation with the practical considerations of applying patches or other fixes within the organization's change management processes. Overall, a proactive and informed approach to addressing this vulnerability will help minimize potential disruptions and ensure the continued stability of network operations. To effectively manage this risk, organizations should not only focus on immediate remediation but also on longer-term strategies for vulnerability management, including regular security assessments, timely patching, and continuous monitoring of network and system vulnerabilities

Technical summary

The Bluetooth HFP Profile protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 is vulnerable to a crash, potentially allowing for denial of service attacks. The crash occurs due to improper handling of certain protocol packets, which could allow attackers to cause a denial of service condition. Further verification is recommended to assess the impact on specific deployments. Network administrators and security teams should review compensating controls for exposed systems while remediation is scheduled and verified. This includes reviewing relevant monitoring, detection, and logs for exposed assets that need extra review. Operators of affected platforms and those responsible for vulnerability management within their organizations should prioritize assessment and remediation efforts based on their specific exposure and risk profile.

Defensive priority

Medium-priority defensive actions recommended due to potential denial of service via Bluetooth HFP Profile protocol dissector crash.

Recommended defensive actions

• Inventory and verify Wireshark installations for versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18
• Apply vendor remediation or compensating controls as available
• Monitor for potential denial of service attempts via Bluetooth HFP Profile protocol dissector

Evidence notes

Evidence from official CVE Program record and NIST NVD vulnerability detail page indicates potential denial of service via Bluetooth HFP Profile protocol dissector crash in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The crash occurs due to improper handling of certain protocol packets, which could allow attackers to cause a denial of service condition. Further verification is recommended to assess the impact on specific deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.