PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76928 Wireshark Foundation CVE debrief

The Wireshark X.509IF protocol dissector is vulnerable to a crash, potentially allowing for denial of service attacks. This issue affects Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The vulnerability is tracked under CVE-2026-76928 and has been assessed with a CVSS score of 7.5. Affected systems include network protocol analysis tools running Wireshark installations. Defenders should verify affected Wireshark installations, review network protocol analysis tool security, and assess potential exposure to denial of service attacks. Further analysis is required to fully understand the impact, including reviewing the official CVE record and NVD detail page for source-provided CVE metadata and specific vulnerability assessments.

Vendor
Wireshark Foundation
Product
Wireshark
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-31
Advisory published
2026-08-19
Advisory updated
2026-08-31

Who should care

Network administrators and security teams responsible for Wireshark installations, as well as individuals concerned with potential denial of service vulnerabilities in network protocol analysis tools, should review and address this vulnerability. This includes operators of affected Wireshark versions, vulnerability management teams, and security personnel responsible for network protocol analysis tool security.

Technical summary

The X.509IF protocol dissector in Wireshark is vulnerable to a crash, which could be exploited for denial of service attacks. Affected versions include 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The vulnerability is tracked under CVE-2026-76928 and has been assessed with a CVSS score of 7.5. This issue affects Wireshark installations, potentially allowing attackers to cause a denial of service.

Defensive priority

High priority due to potential for denial of service attacks

Recommended defensive actions

  • Update Wireshark to a version outside of the affected ranges (4.4.0-4.4.18 and 4.6.0-4.6.7)
  • Implement network monitoring to detect potential exploitation attempts
  • Review and update incident response plans to address potential denial of service attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Evidence from the NVD and CVE Program records indicate a potential denial of service vulnerability in Wireshark's X.509IF protocol dissector. Further analysis is required to fully understand the impact, including reviewing the official CVE record and NVD detail page for source-provided CVE metadata and specific vulnerability assessments. Defenders should verify affected Wireshark installations, review network protocol analysis tool security, and assess potential exposure to denial of service attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-76928 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-76928

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-76928 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76928

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.