CVE-2026-76921

Executive Summary

CVE-2026-76921 is a denial-of-service vulnerability in the Wireshark CMS protocol dissector, affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A crafted network packet processed by the CMS dissector can trigger a use-after-free condition (CWE-416), causing the application to crash. With a CVSS score of 5.5, the vulnerability requires user interaction (e.g., opening a crafted capture file or live capture) and has high availability impact but no confidentiality or integrity impact.

Technical Analysis

The vulnerability resides in the CMS (Content Management System) protocol dissector within Wireshark. The affected component fails to properly manage memory lifecycle during packet parsing, leading to a use-after-free condition (CWE-416). This class of vulnerability occurs when a program continues to reference memory after it has been freed, resulting in undefined behavior that can include application crashes.

Vulnerability Mechanism: The CMS dissector processes network packets or capture files containing CMS protocol data. During the parsing process, memory objects are allocated and subsequently freed. A flaw in the dissector's state management causes the code to access memory that has already been released. This access triggers an access violation or segmentation fault, terminating the Wireshark process.

Attack Surface: The attack surface is local and requires user interaction. An attacker can craft a malicious PCAP file containing CMS protocol packets or inject malformed packets into a live capture session. When a victim opens the crafted file or performs a live capture on a network carrying the malicious traffic, the CMS dissector processes the data and crashes.

Code-Level Considerations: The specific code paths contributing to the use-after-free are not disclosed in the NVD description. Based on the vulnerability class, the issue likely involves:

• Improper reference counting or ownership transfer of protocol tree nodes
• Premature deallocation of dissector context objects
• Race conditions between dissector sub-routines

Insufficient technical detail is available to identify the exact functions or memory structures involved. The crash manifests deterministically when specific CMS packet structures are parsed, making the vulnerability easily reproducible with a crafted capture.

Affected Versions:

• Wireshark 4.6.0 through 4.6.7
• Wireshark 4.4.0 through 4.4.18

The vulnerability has been confirmed fixed in subsequent releases, with patch confidence rated 3/4 based on confirmation from NVD and Debian sources.

Exploitation Scenarios

No public PoC or exploit code is currently available; however, the vulnerability class is well-understood. The attack chain is inferred from the vulnerability mechanism.

Step 1: Reconnaissance/Target Identification An attacker identifies targets running vulnerable Wireshark versions. This can be accomplished through:

• Banner grabbing on systems exposing Wireshark services (rare)
• Social engineering to determine which packet analysis tools the target uses
• Targeted campaigns against security research teams, SOC analysts, or network engineers known to use Wireshark

Step 2: Triggering the Vulnerability The attacker crafts a malicious packet capture file (.pcap/.pcapng) containing CMS protocol packets designed to trigger the use-after-free. Alternatively, on a network with active monitoring, the attacker can send specially crafted CMS packets onto the wire. The victim must then:

• Open the malicious capture file in Wireshark, OR
• Run a live capture on a network segment where the malicious packets are present

Step 3: Payload Execution at Vulnerability-Class Level At the class level, the use-after-free is triggered when the CMS dissector processes a packet that causes memory to be freed prematurely, followed by a subsequent access to that freed memory. This results in an access violation. The attacker does not achieve code execution — the manifestation is a crash of the Wireshark application.

Step 4: Post-Exploitation Impact The immediate impact is denial of service: Wireshark terminates unexpectedly, disrupting the analyst's workflow. In a SOC environment, this can:

• Halt incident response activities
• Prevent network traffic analysis during active investigations
• Require manual restart, creating operational downtime
• Undermine trust in captured evidence if analysis is interrupted

The attack is considered low-severity from a compromise perspective but operationally disruptive. No remote code execution or privilege escalation is achievable with this vulnerability.

Impact Assessment

CVSS Analysis:

• Attack Vector (AV:L): Local — exploitation requires local access to the system
• Attack Complexity (AC:L): Low — no special conditions needed beyond opening a crafted file
• Privileges Required (PR:N): None — no authentication or privileges required
• User Interaction (UI:R): Required — victim must open the file or capture traffic
• Confidentiality (C:N): None — no data exposure
• Integrity (I:N): None — no data modification
• Availability (A:H): High — application crash leads to complete denial of service

Business Impact:

• Operations Teams: Loss of network visibility during Wireshark outages
• Security Teams: Inability to analyze suspicious traffic during active investigations
• Forensic Analysts: Potential loss of unsaved capture data, requiring reacquisition
• Enterprise Risk: Low to moderate, given the local, user-interactive nature of the attack

Blast Radius: The vulnerability is confined to a single workstation. It does not affect the Wireshark server infrastructure, other network tools, or other users on the system. The attack does not propagate or persist. However, in environments where Wireshark is used for continuous monitoring, the crash could leave temporary detection gaps.

EPSS Considerations: The EPSS score of 0.00118 (1.9% percentile) indicates a very low probability of exploitation in the wild. Combined with the absence of CISA KEV listing and no known exploit code, this vulnerability represents a low-priority threat in terms of active exploitation. However, its ease of triggering makes it a viable tool for disruption in targeted environments.

Detection Guidance

Sigma Rule

title: Wireshark CMS Dissector Crash - Malicious Capture File
id: 6f7d5e2a-9c4b-4a11-b2d8-1f3c4e5a6b7c
status: experimental
description: Detects Wireshark crashes potentially caused by crafted CMS protocol packets (CVE-2026-76921)
author: Valtersit Threat Intelligence
date: 2026/02/28
logsource:
    category: process_creation
    product: windows
detection:
    selection_crash:
        Image|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
        ExitCode:
            - '0xC0000005'  # Access Violation
            - '0xC0000409'  # Stack Buffer Overflow
            - '0xC0000374'  # Heap Corruption
    selection_recent:
        TimeCreated:
            - 'last: 5m'  # Crash events within 5 minutes
    condition: selection_crash and selection_recent
level: medium
falsepositives:
    - Legitimate Wireshark crashes due to other bugs or resource exhaustion
    - Third-party plugins causing memory errors
tags:
    - attack.t1499
    - cve.2026-76921

YARA Rule

rule CVE_2026_76921_Wireshark_CMS_Crash
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious PCAP files crafted to trigger CMS dissector use-after-free in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18"
        cve = "CVE-2026-76921"
        date = "2026-02-28"
        version = "1.0"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76921"

    strings:
        $pcap_magic = { D4 C3 B2 A1 }  // Standard PCAP magic number (little-endian)
        $pcapng_magic = { 0A 0D 0D 0A }  // PCAPNG magic
        $cms_proto = "cms" ascii nocase
        $cms_alt = "CMS" ascii
        // Protocol type field patterns commonly used in CMS dissector triggers
        $ptrn1 = { 43 4D 53 }  // "CMS" ASCII
        $ptrn2 = { 70 61 63 6B 65 74 73 }  // "packets"
        $ptrn3 = { 6D 61 6C 66 6F 72 6D 65 64 }  // "malformed"

    condition:
        uint32(0) == 0xa1b2c3d4 or uint32(0) == 0xa1b23c4d or
        uint32(0) == 0x0a0d0d0a or
        filesize > 1000 and
        2 of them and
        ($cms_proto or $cms_alt)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT Possible CMS Protocol Dissector Crash Payload (CVE-2026-76921)"; flow:established,to_server; content:"|43 4d 53|"; depth:64; content:"|00 00 00 00|"; within:128; classtype:attempted-dos; sid:202602281; rev:1; metadata:created_at 2026_02_28, cve CVE-2026-76921, severity major, mitre_tactic TA0040, mitre_technique T1499;)

Note: This rule detects the presence of CMS protocol traffic with characteristics consistent with malformed packet structures. Given the local nature of the vulnerability and lack of a well-known network signature, this rule provides heuristic detection only.

Elastic Detection

// EQL rule to detect Wireshark crashes on Windows/Unix systems
sequence by host.name with maxspan=1m
  [ process where process.name : "wireshark.exe" or process.name : "tshark.exe"
    and event.type : "start" ]
  [ process where process.name : "wireshark.exe" or process.name : "tshark.exe"
    and event.type : "end"
    and process.exit_code : (0xC0000005, 0xC0000409, 139, -11) ]

Splunk SPL Query

index=windows OR index=unix sourcetype=WinEventLog:Security OR sourcetype=syslog
| search (process_name=wireshark.exe OR process_name=tshark.exe OR process_name=wireshark) 
  AND (exit_code=0xC0000005 OR exit_code=0xC0000409 OR exit_code=139 OR exit_code=-11)
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, exit_code
| where count > 1
| table first_seen last_seen host process_name exit_code count
| sort - first_seen

Wazuh OSSEC Rule

<group name="wireshark,">
    <rule id="100821" level="10">
        <decoded_as>syslog</decoded_as>
        <match>wireshark</match>
        <regex>Segmentation fault|Fatal error|core dumped|Aborted</regex>
        <description>Wireshark crash detected - possible CVE-2026-76921 CMS dissector exploitation</description>
        <group>cve_2026_76921,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
    <rule id="100822" level="10">
        <decoded_as>json</decoded_as>
        <field name="process.name">wireshark|tshark</field>
        <match>exit_code.*0xC0000005|exit_code.*0xC0000409|exit_code.*139</match>
        <description>Wireshark/tshark terminated with memory error - potential CVE-2026-76921 exploit</description>
        <group>cve_2026_76921,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
    <rule id="100823" level="8">
        <decoded_as>syslog</decoded_as>
        <match>wireshark.*crash|tshark.*crash</match>
        <description>Wireshark or tshark crash event observed</description>
        <group>cve_2026_76921,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources confirm fix)

1) Immediate Mitigations

• Upgrade Wireshark: Immediately upgrade to Wireshark 4.6.8 or later (for 4.6.x line) or 4.4.19 or later (for 4.4.x line). These versions contain the CMS dissector fix.
• Disable CMS Dissector: As a temporary measure, users can disable the CMS protocol dissector via Wireshark → Analyze → Enabled Protocols → uncheck "CMS". This prevents the vulnerable code from executing.
• User Awareness: Educate analysts on the risks of opening capture files from untrusted sources. Implement a "sandbox first" workflow where external PCAP files are opened in a restricted environment.

2) Patch/Upgrade Steps

1. Download the latest Wireshark version from the official website (https://www.wireshark.org/download.html) or your distribution's package repository.
2. For Debian/Ubuntu systems:

   sudo apt update
   sudo apt install wireshark
   

3. For Windows: Replace the existing installation with the updated installer.
4. Verify the installed version:

   wireshark --version
   

   Confirm the version is ≥ 4.6.8 or ≥ 4.4.19.

3) Long-Term Hardening

• Capture File Validation: Implement pre-scanning of external PCAP files using tools like capinfos, editcap, or mergecap before opening in the interactive GUI.
• Headless Processing: For automated packet analysis in CI/CD pipelines, use tshark with the -r flag and consider running it in a containerized environment with restart policies.
• Regular Patch Management: Subscribe to Wireshark security advisories (https://www.wireshark.org/security/) and apply updates within 30 days of release.
• Network Segmentation: For live capture scenarios, monitor network segments with attack surface reduction to minimize exposure to malicious traffic.
• EPSS-Based Prioritization: Given the low EPSS score, this vulnerability should be remediated as part of scheduled maintenance rather than emergency patching, unless the environment has high exposure to untrusted packet sources.

References

1. [NVD Entry] https://nvd.nist.gov/vuln/detail/CVE-2026-76921
2. [Debian Security Tracker] https://security-tracker.debian.org/tracker/CVE-2026-76921
3. [Wireshark Security Advisories] https://www.wireshark.org/security/
4. [CWE-416 Reference] https://cwe.mitre.org/data/definitions/416.html
5. [Wireshark Download Page] https://www.wireshark.org/download.html

Threat Actor Campaigns: No known threat actor campaigns targeting this specific CVE have been reported as of publication. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. The EPSS score (0.00118, 1.9% percentile) indicates minimal in-the-wild exploitation activity. No exploit code has been publicly released; the public PoC referenced in the metadata likely describes the proof-of-concept technique or crash reproduction method rather than a weaponized exploit artifact. Organizations should treat this as a low-priority but legitimate patch item.