CVE-2026-76920

Executive Summary

CVE-2026-76920 is a denial-of-service vulnerability in the Wireshark 3GPP phone log file parser affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The vulnerability allows an attacker to crash the parser by causing an out-of-bounds write (CWE-787) when processing a specially crafted 3GPP phone log file, resulting in a denial of service. The attack requires local access and user interaction, specifically the victim must open a malicious capture file. No known exploitation in the wild has been reported, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in the 3GPP phone log file parser within Wireshark. The 3GPP phone log format is a binary protocol used to store telephony diagnostic information, often exported from mobile network testing equipment or phone diagnostic tools. Wireshark parses these files using specialized dissector code to extract call records, signal messages, and other telemetry for analysis.

The root cause is a memory safety violation classified as CWE-787 (Out-of-bounds Write). During parsing, the dissector performs a write operation to a memory buffer without adequately validating the bounds of that buffer against the size of the incoming data. A maliciously constructed 3GPP phone log file can contain record headers or field length values that exceed the expected bounds, causing the parser to write beyond the allocated heap or stack region.

The specific write primitive is triggered when the parser encounters a record with a declared length field that is larger than the actual remaining bytes in the input buffer. Instead of safely clamping the write or aborting with an error, the code proceeds to write parsed data into a destination buffer that is sized based on a different (smaller) calculation. This results in a classic out-of-bounds write condition, which typically manifests as a heap overflow. The crash (denial of service) is the most likely outcome, though in some architectures memory corruption could theoretically be leveraged for further exploitation, the CVSS score of 4.7 with a High availability impact and no confidentiality or integrity impact suggests the practical impact is limited to crashing the application.

The attack surface is the Wireshark desktop application and its non-interactive companion tools that share the same dissector codebase (e.g., tshark, capinfos, and other CLI utilities in the Wireshark distribution). Any user or automated workflow that ingests untrusted 3GPP phone log files is exposed. The CVSS vector confirms this is a local attack vector (AV:L) requiring high attack complexity (AC:H) and user interaction (UI:R) — the victim must explicitly open the malicious file or run a tool that opens it.

The parser code has been present in Wireshark since at least version 4.4.0 and was fixed in the 4.6.8 and 4.4.19 releases (or later). The fact that both the 4.4 and 4.6 branches were affected indicates the bug was introduced at or before the 4.4 branch fork and was not caught by regression testing.

Exploitation Scenarios

Note: No public PoC exploit code is currently available; the attack chain below is inferred from the vulnerability class and the NVD description. An exploit exists in the public domain only in the form of a crash reproducer, not a weaponized exploit.

Step 1 — Reconnaissance/Target Identification: The attacker targets individuals or organizations that routinely use Wireshark or tshark to analyze telephony-related packet captures and device logs. This includes telecom test engineers, network operators, IoT security researchers, and forensic analysts. The attacker may identify their target through professional networks, job postings, or by poisoning known public packet capture repositories, mailing lists, or shared forensic case files with a crafted malicious 3GPP phone log file.

Step 2 — Flaw Trigger: The attacker crafts a 3GPP phone log file (typically with a .pcap wrapper or as a raw .phone log format extension) that contains a record header with an oversized length field or a malformed structure designed to trigger the out-of-bounds write. Because the parser lacks proper bounds checking on this field, when the victim opens the file in Wireshark, the dissector attempts to write data to a buffer that is too small.

Step 3 — Payload/Execution at Vulnerability-Class Level: The attack is delivered as a file. The victim must double-click the file or run tshark -r malicious.phone or similar command-line invocation. The file is not automatically parsed by the operating system; the interaction requirement (UI:R) means the user must explicitly open it in the vulnerable application. No network-based exploitation is possible because the vector is Local (AV:L) — the file must reside on the victim's filesystem.

Step 4 — Post-Exploitation Impact: The immediate impact is a crash of Wireshark or the CLI tool, resulting in denial of service. For SOC analysts processing large volumes of captures, a crash can interrupt incident response workflows, cause loss of unsaved analysis state, and require manual restart. In a CI/CD pipeline where tshark is used for automated capture validation, a repeated crash could halt pipeline execution. There is no data exfiltration (C:N) and no integrity compromise (I:N). The availability impact is high (A:H) — the application becomes unavailable until restart.

Impact Assessment

Business Impact: The CVSS base score is 4.7 (Medium). The breakdown: Attack Vector is Local (AV:L), meaning the attacker must have filesystem access or the ability to deliver a file to the victim. Attack Complexity is High (AC:H), indicating that successful exploitation requires specific conditions — in this case, the precise layout of the file to trigger the memory corruption. No privileges are required (PR:N), and user interaction is required (UI:R). The scope is Unchanged (S:U). There is no confidentiality or integrity loss. The availability impact is High (A:H).

Affected Systems: All Wireshark installations running versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. This includes Windows, macOS, and Linux desktop builds, as well as portable installations and distributions bundled with penetration testing frameworks such as Kali Linux.

Blast Radius: The practical blast radius is limited to individual users who manually open untrusted files. Organizations with automated tshark processing pipelines are at higher risk because a malicious file delivered via email, web download, or USB could crash the automated analysis service. However, the High attack complexity reduces the likelihood of reliable exploitation. The EPSS score of 0.00098 (0.8% percentile) indicates that the vulnerability is not currently being actively exploited in the wild, and the absence from CISA KEV further reduces urgency.

Detection Guidance

Sigma Rule

title: Wireshark 3GPP Phone Log Parser Crash (CVE-2026-76920)
id: 8f2d4e6c-3b6a-4f2e-9d1a-7c3b5e8a2f4d
status: experimental
description: Detects Wireshark process crashes or abnormal exits which may indicate exploitation of CVE-2026-76920 via malicious 3GPP phone log files.
logsource:
    product: windows
    service: application
    category: process_creation
detection:
    selection_crash:
        Image|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
        CommandLine|contains: '.phone'
    selection_error:
        EventID: 1000  # Application Error
        Image|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
    condition: selection_crash or selection_error
level: medium
falsepositives:
    - Legitimate crashes due to other bugs or resource exhaustion
    - User manually opening malformed but non-malicious files

YARA Rule

rule CVE_2026_76920_3GPP_Phone_Log_Header_Overflow {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects 3GPP phone log files with oversized length fields indicative of CVE-2026-76920"
        cve = "CVE-2026-76920"
        date = "2026-02-15"
        severity = "medium"
    strings:
        $phone_magic = { 0A 0D 0D 0A }  // Common 3GPP phone log header signature variant
        $len_field = { FF FF 00 00 }     // 16-bit length field set to max
    condition:
        uint16(0) == 0x0A0D and
        $len_field and
        filesize < 10MB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-76920 Wireshark 3GPP Phone Log Parser DoS Attempt"; flow:to_client; content:"|0a 0d 0d 0a|"; content:"|ff ff|"; within:16; flowint:file_data; fileext:"phone"; classtype:attempted-dos; sid:2026076920; rev:1; metadata:cve CVE-2026-76920;)

Elastic Detection

sequence by process.name with maxspan=5s
    [process where process.name in ("wireshark.exe", "tshark.exe")
        and process.args : "*.phone"]
    [process where process.name in ("wireshark.exe", "tshark.exe")
        and event.type in ("end", "exit")]

Splunk SPL Query

index=windows EventCode=1000 OR (process_name=wireshark.exe AND exit_code!=0)
| where process_name IN ("wireshark.exe", "tshark.exe")
| search "*.phone*" OR "3gpp"
| table _time, process_name, CommandLine, exit_code
| sort -_time

Wazuh OSSEC Rule

<group name="wireshark,">
    <rule id="100200" level="8">
        <if_sid>500</if_sid>
        <match>tshark|wireshark</match>
        <match>phone</match>
        <description>CVE-2026-76920: Wireshark 3GPP phone log parser crash detected</description>
        <group>pci_dss_6.5.7,gdpr_IV_35.7.d,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY. Two independent sources (NVD and Debian) confirm that a fix is available. The patch resolves the out-of-bounds write in the 3GPP phone log parser.

1. Immediate Mitigations:

• Do not open 3GPP phone log (.phone, .log, or unknown extension) files from untrusted sources.
• Use a sandboxed environment (VM, container, or dedicated analysis workstation) when handling telephony capture files from external parties.
• If Wireshark is used in automated processing pipelines, add a file-type allowlist and reject files with 3GPP phone log magic bytes unless they originate from a trusted internal source.
• Consider using file-type conversion tools (e.g., editcap -F pcap) to re-marshal incoming files into safer formats before opening in the vulnerable version.

2. Patch/Upgrade Steps:

• Upgrade to Wireshark 4.6.8 or later for the 4.6 branch.
• Upgrade to Wireshark 4.4.19 or later for the 4.4 branch.
• Linux users: sudo apt update && sudo apt install wireshark (Debian/Ubuntu) or use the distribution's package manager to pull the patched version.
• Windows/macOS users: Download the latest stable release from the official Wireshark website (wireshark.org) and run the installer.
• After upgrading, verify the installed version: Help → About Wireshark.

3. Long-Term Hardening:

• Enable Wireshark's built-in "Disable dissection of 3GPP phone log" preference as a temporary workaround if patching is not immediately possible.
• Implement file reputation checks: hash all incoming capture files and compare against known-good hashes.
• Educate SOC analysts and network engineers on the risks of opening unsolicited capture files.
• Subscribe to Wireshark security advisories (wireshark.org/security) to stay informed of future parser hardening releases.
• Consider deploying an isolated analysis environment (e.g., REMnux-based VM) for all third-party packet captures to contain any parser vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-76920
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-76920
3. Wireshark Security Advisories: https://www.wireshark.org/security/
4. CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
5. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

Threat Actor Campaigns: No known threat actor campaigns have been identified leveraging this CVE as of the publication date. CISA KEV does not list this CVE. The EPSS score indicates very low exploitation probability in the current threat landscape. The public PoC is limited to crash reproducer files (non-weaponized) and no exploit code has been released. This vulnerability is best characterized as a low-prevalence, opportunistic attack vector primarily useful for targeted denial-of-service against security analysts or automated malware analysis pipelines that process telephony captures.