CVE-2026-76924

Executive Summary

CVE-2026-76924 is a denial-of-service (DoS) vulnerability in the Kerberos protocol dissector bundled in Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The flaw stems from an out-of-bounds read (CWE-125) that allows a crafted network packet to crash the dissector, resulting in application termination or unstable behavior. The vulnerability carries a CVSS score of 5.5 (Medium) with a local attack vector requiring user interaction, meaning an attacker must convince a user to open a crafted capture file or force the protocol dissector to process malicious packet data via a live capture. No public proof-of-concept, vendor patch, or CISA KEV inclusion has been identified at the time of writing.

Technical Analysis

CVE-2026-76924 is an out-of-bounds read vulnerability residing in Wireshark's Kerberos protocol dissector. The Kerberos protocol is a network authentication protocol commonly used in Active Directory environments, and its dissection involves parsing TGS (Ticket-Granting Service) and AS (Authentication Service) messages that contain multiple variable-length fields, including realm names, principal names, and ticket data.

The vulnerability class, CWE-125 (Out-of-bounds Read), indicates that the dissector attempts to read data at a memory offset beyond the bounds of the allocated buffer. This typically occurs when:

• The dissector trusts length fields within the Kerberos message without performing adequate validation.
• Encrypted or checksummed sections of the Kerberos ticket are processed without accounting for truncation or malformed lengths.
• Parsing of ASN.1 (Abstract Syntax Notation One) structures (on which Kerberos is based) fails to properly handle multi-byte length fields or end-of-data markers.

In the affected versions (4.6.0 to 4.6.7 and 4.4.0 to 4.4.18), the dissector fails to properly validate the length of a specific field before performing a read operation. A malicious actor can craft a Kerberos packet — or a pcap capture file containing such a packet — that causes the dissector to read beyond the allocated heap or stack buffer. This causes a segmentation fault or assertion failure in Wireshark, crashing the application.

Notably, this is a local attack vector (AV:L) with a user interaction requirement (UI:R). The attacker must entice the victim into either:

1. Opening a maliciously crafted capture file (e.g., .pcap, .pcapng) via Wireshark's open-file dialog, or
2. Having the victim perform a live capture on a network segment where the attacker can inject the malformed Kerberos packets.

Since the protocol dissector is invoked automatically when a packet of the matching protocol type is encountered, the crash occurs without any user action beyond initiating the capture or opening the file.

The technical detail provided in the NVD description is sparse — no specific function names, structure definitions, or exact packet offsets are listed. This analysis is therefore based on the vulnerability class (CWE-125) and the known behavior of Kerberos ASN.1 dissectors. Given the crash impact, the failure likely resides in the handling of a Kerberos extension field such as PA-ENC-TIMESTAMP, the authorization data, or the ticket integrity checksum, where an incorrect length attribute leads to an invalid memory read.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is currently available. The attack chain below is inferred strictly from the vulnerability class (out-of-bounds read) and the attack surface described in the NVD entry.

Step 1 — Reconnaissance / Target Identification The attacker identifies a target running Wireshark 4.6.0–4.6.7 or 4.4.0–4.4.18. Victim identification may be achieved through:

• OSINT (e.g., Shodan scanning for exposed RDP or SMB services where pcap analysis is common).
• Enumerating internal corporate networks where security analysts or IT staff frequently use Wireshark for troubleshooting.

Step 2 — Flaw Trigger The attacker crafts a specific network packet containing a malformed Kerberos ASN.1-encoded message. The packet includes a length field that is either impossibly large, zeroed, or identifies a memory region beyond the current buffer. When Wireshark's Kerberos dissector parses this packet, it fails to validate that the field offset and length remain within the allocated buffer bounds, resulting in an out-of-bounds read.

Step 3 — Payload / Execution Method (Class level) For local attack vectors (the CVSS AV:L component), two primary delivery methods exist:

• File-based attack: The attacker delivers the crafted traffic inside a .pcapng or .pcap file via email, a USB drive, or a file-sharing service. When the user opens the file in Wireshark, the dissector automatically processes packets, triggering the crash before the user can inspect or stop the action.
• Network-based attack: The attacker injects the crafted packet into a network segment where the victim is actively capturing. This requires the victim to be running a live capture (e.g., while analyzing traffic on a suspicious switch port). The malformed packet is recognized by the Kerberos dissector and causes the crash.

Step 4 — Post-Exploitation Impact The immediate result is a crash of Wireshark, potentially causing:

• Loss of unsaved capture data (though Wireshark typically auto-saves temporary capture files, the user loses the session context).
• Disruption of ongoing security analysis, incident response, or network troubleshooting.
• In environments where Wireshark is used as a backend for automated analysis tools (e.g., tshark invoked via scripts), the crash may cause automated pipelines to fail or loop, creating availability degradation.

While the CVSS vector indicates no confidentiality or integrity impact (C:N/I:N), repeated crashes can constitute a persistent denial-of-service for the analyst's workstation, disrupting security operations. Since no memory corruption beyond the crash is documented, privilege escalation or code execution is not inferred from this data.

Impact Assessment

Business Impact: The primary impact is availability (CVSS A:H). Wireshark is a foundational tool in network security operations, incident response, and network engineering. A crash in the Kerberos dissector prevents analysts from analyzing captured traffic, which can directly delay security incident investigations and network fault diagnosis.

Affected Systems: All installations of Wireshark 4.6.0 through 4.6.7 (latest in the 4.6 branch) and 4.4.0 through 4.4.18 (latest in the 4.4 branch). Both the GUI application and the command-line variant (tshark) are affected since they share the same dissector engine.

Blast Radius:

• CVSS Score: 5.5 (Medium) — vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
  • The Local attack vector limits exploitation to a single host, but the High availability impact means that a single crash can take down the analysis tool.
  • User interaction required (UI:R) reduces the practical exploitability in automated attack chains but does not prevent phishing-based delivery of a malicious pcap.
  • No privileges required (PR:N) — any user with access to open Wireshark is a valid target.

Operational Impact: For MSSPs (Managed Security Service Providers) or internal SOCs that process large numbers of pcap files from remote sensors, a malicious capture file could crash analysis workstations or CI/CD pipelines that use tshark for automated packet extraction.

Detection Guidance

The following detection rules target the network-level artifacts and behavioral indicators associated with Kerberos dissector crash attempts. Note that since this is a local crash vulnerability, network detection is limited to identifying the malformed Kerberos packets that would trigger the flaw.

Sigma Rule

title: Wireshark Kerberos Dissector Crash - Malformed ASN.1 Length
id: 1234abcd-5678-9ef0-1234-56789abcdef0
status: experimental
description: Detects attempts to send malformed Kerberos packets that could trigger CVE-2026-76924, an out-of-bounds read in the Kerberos dissector of Wireshark 4.4.0-4.4.18 and 4.6.0-4.6.7.
tags:
    - attack.t1203
    - attack.t1059
logsource:
    product: wireshark
    service: kerberos
detection:
    selection:
        event.action: "Dissector Error"
        protocol: kerberos
        error.type: "Bound check failure"
    condition: selection
level: high
falsepositives:
    - Legitimate Kerberos traffic with unusual but valid ASN.1 encodings
    - Corrupted capture files due to transmission errors

YARA Rule

rule Wireshark_Kerberos_Dissector_Crash_CVE_2026_76924
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects Kerberos packet capture files containing malformed ASN.1 length fields that trigger CVE-2026-76924"
        date = "2026-01-01"
        references = "CVE-2026-76924"
        severity = "medium"

    strings:
        // Kerberos ASN.1 application tag indicating TGS-REQ
        $asn1_app_tag = { 60 82 } // [APPLICATION 0] with 2-byte length
        $asn1_app_tag2 = { 61 82 } // [APPLICATION 1] with 2-byte length
        // Malformed length indicator - length field claiming more data than available
        // Common in OOB read exploitation where length > actual buffer
        $large_kerb_len = { 6d ff } // realm tag with 0xFFFF length (invalid)
        $unlikely_len = { 6e 84 } // principal name tag with 4-byte length encoding

    condition:
        uint16(0) == 0x4d3c and            // PCAP magic number (little-endian)
        (($asn1_app_tag or $asn1_app_tag2) and
         ($large_kerb_len or $unlikely_len)) and
        filesize > 100
}

Suricata IDS Rule

alert tcp any any -> any 88 (msg:"ET EXPLOIT Possible Kerberos Dissector Crash CVE-2026-76924"; flow:established,to_server; content:"|60 82 00 01|"; depth:4; content:"|6d ff ff|"; within:256; reference:cve,2026-76924; reference:url,valtersit.com/cve-2026-76924; classtype:attempted-dos; sid:202600001; rev:1;)

Elastic Detection

// EQL query to identify Wireshark crash events following Kerberos packet processing
sequence by host.name with maxspan=1m
  [ process where process.name == "wireshark.exe" and event.action == "start" ]
  [ process where process.name == "wireshark.exe" and event.action == "end"
     and process.exit_code != 0
     and process.parent.name == "explorer.exe" or process.parent.name == "cmd.exe" ]
  [ file where file.name == "*.pcap" and file.extension in ("pcap", "pcapng")
     and file.size >= 1000 ]

Splunk SPL Query

index=windows sourcetype=WinEventLog
| where EventID=4688 (Process Create) OR EventID=5925 (Scheduled Task)
| rename CommandLine as cmdline
| search cmdline="*wireshark*" OR cmdline="*tshark*"
| transaction host maxspan=5m
| stats count by host, _time, user, cmdline
| where count >= 2
| eval crash_indicators = if(match(cmdline, "(?i)kerberos|\.pcap|\.pcapng"), 1, 0)
| where crash_indicators = 1
| table _time, host, user, cmdline, count
| sort - _time

Wazuh OSSEC Rule

<group name="wireshark,">
  <rule id="202601" level="10">
    <if_sid>5715</if_sid>
    <match>wireshark</match>
    <description>Wireshark crash on Kerberos handling - possible CVE-2026-76924 exploitation</description>
    <group>vulnerability,pentest,cve,</group>
  </rule>

  <rule id="202602" level="8">
    <if_sid>530,550</if_sid>
    <match>wireshark|tshark</match>
    <description>Wireshark process terminated abnormally after packet analysis</description>
    <group>dos,wireshark,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor patch, security advisory, or version update has been identified from any tracked source at the time of writing. Wireshark 4.4.19 and 4.6.8 (or later) should be monitored in the vendor's release announcements for the fix.

1) Immediate Mitigations

• Restrict capture file ingestion: Avoid opening .pcap/.pcapng files from untrusted sources (e.g., unsolicited email attachments, USB drives from external parties).
• Use sandboxing: Analyze suspicious capture files in an isolated VM or container environment to prevent disruption of production analysis workstations.
• Fallback to older stable version: If only the vulnerable versions are available and the environment cannot wait for a patch, revert to the last known-stable version < 4.4.0 or test if 4.6.8+ is available.
• Disable Kerberos dissector temporarily (as a last resort): In Wireshark, navigate to Analyze → Enabled Protocols → uncheck Kerberos if Kerberos traffic analysis is not immediately required. This eliminates the attack surface but reduces analytical capability.

2) Patch / Upgrade Steps

• Monitor the Wireshark official release feed (https://www.wireshark.org/download.html) for versions 4.4.19 and 4.6.8.
• Upgrade to the patched version immediately upon release.
• For enterprise deployments using tshark in scripts or CI pipelines, update all packaged Wireshark installations (e.g., MSI deployments, Chocolatey packages, apt/deb packages).
• Verify integrity of the upgrade with SHA256 checksums published by the vendor.

3) Long-Term Hardening

• Segment analysis workstations — run Wireshark on dedicated analysis hosts that have no access to production credentials or sensitive data.
• Implement capture-file scanning — add a pre-analysis step using a patched tshark or an IDS rule engine to screen incoming capture files before they reach the analyst's workstation.
• Enable Windows Defender Exploit Guard (if on Windows) — configure ASLR and DEP enforcement for wireshark.exe to reduce the residual risk if an attacker escalates from OOB read to RCE in a future variant.
• Establish vendor notification process — subscribe to Wireshark's security-announce mailing list for immediate patch notifications.
• Regular security training — educate SOC analysts on the risks of opening untrusted capture files, emphasizing that pcap files are executable-equivalent attack vectors.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-76924 (Official CVE description and CVSS metrics)
2. Wireshark Download Portal — https://www.wireshark.org/download.html (Monitor for patched versions 4.4.19 / 4.6.8)
3. Wireshark Release Notes — https://www.wireshark.org/docs/relnotes/ (Track version changelogs for dissector fixes)
4. CWE-125 Reference — https://cwe.mitre.org/data/definitions/125.html (Out-of-bounds Read weakness class description)

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public PoC or exploit code is available; exploitation is currently "Unknown" but is plausible given the low technical barrier for crafting malformed ASN.1 Kerberos messages combined with social-engineering delivery of a pcap file.