CVE-2026-76926

Executive Summary

CVE-2026-76926 is a denial-of-service vulnerability in the BUSMASTER file parser of Wireshark, a widely deployed network protocol analyzer. Versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 are affected, with the flaw causing an abnormal process exit when parsing malformed BUSMASTER capture files. An attacker can trigger this by delivering a specially crafted BUSMASTER file to a target user, who must manually open the file, resulting in termination of the Wireshark application (loss of availability). The vulnerability carries a low CVSS score of 3.1 due to the high attack complexity, requirement for user interaction, and lack of confidentiality or integrity impact.

Technical Analysis

The vulnerability resides in the BUSMASTER file parser within Wireshark. BUSMASTER is an open-source tool used for automotive network simulation, analysis, and testing — primarily for CAN (Controller Area Network) and LIN (Local Interconnect Network) bus protocols. Wireshark includes a dissector/parser for BUSMASTER log files to allow analysts to inspect captured automotive network traffic.

The flaw is classified as CWE-617 — Reachable Assertion. This indicates that the parser contains an assertion or invariant check that the codebase expects to always hold true. When a maliciously crafted BUSMASTER file is parsed, the assertion becomes false, causing Wireshark to log a failure and terminate the process abnormally — effectively an intentional crash triggered by malformed input. This is distinct from a memory-safety flaw (e.g., buffer overflow); it is a logic-level failure where the parser fails to validate input before reaching a state that violates an internal invariant.

The attack surface is the file-import pathway. Wireshark supports opening BUSMASTER files via the user interface (File → Open or drag-and-drop) and via command-line invocation (e.g., wireshark file.bm). Because the parser is invoked only when a BUSMASTER file is explicitly opened, the vulnerability is not remotely exploitable without user interaction — an attacker cannot exploit it via network traffic sniffing alone.

The affected parser version range spans two maintenance branches (4.4.x and 4.6.x), indicating the flaw was introduced at or before version 4.4.0 and was not corrected in either branch until the respective subsequent releases (4.4.19 and 4.6.8 per patch confirmations from NVD and Debian).

The exact trigger condition — the precise field value or file structure that violates the assertion — is not specified in the available advisory data. Given the low CVSS score (Attack Complexity: High, Availability: Low), the malformed file likely requires a specific combination of fields or a structured binary layout that is uncommon. Insufficient technical detail is available regarding the exact field names or byte offsets that trigger the assertion.

Exploitation Scenarios

Based strictly on the vulnerability class (CWE-617 Reachable Assertion) and the available description:

1. Reconnaissance / Target Identification: An attacker identifies a target who regularly uses Wireshark in automotive, embedded systems, or industrial control environments — e.g., automotive engineers, firmware reverse engineers, or security researchers analyzing CAN bus traffic. The attacker does not need network access; they need a delivery channel for a malicious file.

2. Triggering the Flaw: The attacker crafts a BUSMASTER capture file that contains malformed structure designed to violate an internal assertion in the parser. The file format must be recognizable by Wireshark's BUSMASTER dissector (typically a .bm or .txt file with BUSMASTER-formatted log lines). The attacker then delivers this file via phishing email, a compromised website, a USB drive, or a shared repository that the target is likely to pull from.

3. Payload / Execution Method: At the vulnerability-class level, the execution method is a parser assertion failure. When the victim opens the file in Wireshark (via double-click or File → Open), the parser reads the file, hits the malformed section, triggers the assertion, and the process aborts. No code execution is achieved directly — the impact is limited to a denial of service of the Wireshark application itself.

4. Post-Exploitation Impact: The immediate impact is Wireshark crashing, and any unsaved capture data in memory is lost. If Wireshark is used on a shared workstation or as part of an automated analysis pipeline (e.g., periodic file ingestion via tshark in scripts), the crash could cause workflow disruption, missed analysis, or cascading failures in dependent tooling. Repeatedly delivering such files could be used to persistently deny the analyst their primary tool — a form of targeted harassment or productivity denial. On Linux/Unix systems, repeated crashes could also contribute to system-level resource depletion if the process is restarted in a loop by a supervisor, though this is a secondary effect.

It is important to note that no public PoC or exploit code is available at this time. The attack chain is inferred from the vulnerability class and the description. The high attack complexity (AC:H) in the CVSS vector suggests that the attacker must construct a file that reliably triggers the assertion — this may require reverse engineering the parser to determine the exact condition, which raises the bar for exploitation but does not eliminate it.

Impact Assessment

Business Impact: Low severity (CVSS 3.1). The vulnerability provides no confidentiality or integrity impact — it is purely an availability issue for the Wireshark application. The availability impact is itself rated Low (A:L), meaning the crash affects only the Wireshark process, not the underlying operating system or other applications.

Affected Systems: All installations of Wireshark 4.6.0–4.6.7 and 4.4.0–4.4.18 where the BUSMASTER parser is enabled (default in standard builds). This includes Windows, Linux, and macOS distributions of Wireshark, as well as command-line utilities that share the same parsing engine (e.g., tshark, dumpcap when reading files).

Blast Radius: Limited to environments that handle BUSMASTER log files. Organizations in the automotive sector, ECU (electronic control unit) testing, manufacturing, and automotive security research are the most likely to be impacted. General-purpose network analysis teams that never open BUSMASTER files are effectively unaffected.

EPSS Consideration: The EPSS score of 0.00178 (7.4th percentile) indicates a very low predicted probability of exploitation in the wild within the next 30 days. Combined with the absence of a KEV listing, this suggests that the vulnerability is not currently a target of active exploitation campaigns. However, the presence of public PoC indicators (PoC/Exploit: Public, though no exploit code exists) suggests security researchers may already be examining the parser, and a reliable exploit could emerge later.

Detection Guidance

Detection of this vulnerability is challenging because the malicious file is static and does not generate network traffic. Detection focuses on (a) monitoring for Wireshark process crashes and (b) inspecting files for malformed BUSMASTER structure before opening.

Sigma Rule

title: Wireshark BUSMASTER Parser Crash - Process Termination
id: 8f3a7c2e-9b1d-4f6a-8e2c-1a5d7f9b3c11
status: experimental
description: Detects Wireshark or tshark process crashes consistent with CVE-2026-76926, a BUSMASTER file parser assertion failure causing denial of service.
author: valtersit.com Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_wireshark:
        Image|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
            - '\wireshark-gtk.exe'
    selection_event:
        EventID: 4688
        NewProcessName|endswith:
            - '\wireshark.exe'
            - '\tshark.exe'
    filter_clean_exit:
        CommandLine|contains:
            - '--version'
            - '-h'
            - '--help'
    condition: selection_wireshark and selection_event and not filter_clean_exit
    timeframe: 30s
level: low
falsepositives:
    - Legitimate user closing Wireshark quickly after launching
    - Automated tshark batch jobs with malformed input files
tags:
    - attack.t1499
    - cve.2026.76926

YARA Rule

/*
 * YARA rule to detect malformed BUSMASTER files
 * targeting the Wireshark parser (CVE-2026-76926).
 * BUSMASTER log files are ASCII text with lines like:
 * "Rx(0008) 00 01 02 ..." or similar structured logs.
 * This rule looks for abnormal line structure that may trigger
 * assertion failures in the parser.
 */
rule CVE_2026_76926_BUSMASTER_MALFORMED {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects suspicious BUSMASTER log files likely to crash Wireshark 4.6.0-4.6.7 / 4.4.0-4.4.18"
        reference = "CVE-2026-76926"
        date = "2026-01-15"
        severity = "low"

    strings:
        $busmaster_hdr1 = "BUSMASTER" ascii nocase
        $busmaster_hdr2 = "Rx(" ascii
        $busmaster_hdr3 = "Tx(" ascii
        $busmaster_hdr4 = "ERR(" ascii
        $suspicious_long = /(Rx|Tx|ERR)\([0-9]{10,}\)/
        $suspicious_char = /([^0-9a-fA-FxX\(\)\s,:-]){20,}/

    condition:
        uint16(0) == 0x0A0D or filesize > 0 and
        (
            (1 of ($busmaster_hdr*) and $suspicious_long) or
            (1 of ($busmaster_hdr*) and $suspicious_char)
        )
}

Note: This YARA rule is heuristic in nature, as the exact malformed byte/character pattern that triggers the assertion is not publicly documented. It targets anomalous structures in BUSMASTER-like files. Update the pattern as more technical details become available.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-76926 Potential BUSMASTER File Download - Wireshark DoS"; flow:established,to_client; file.data; content:"BUSMASTER"; nocase; fileext:"bm"; classtype:attempted-dos; sid:202676926; rev:1; reference:cve,2026-76926; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Important note on Suricata: This vulnerability is not network-based, and Suricata's detection capability here is inherently weak. The rule above attempts to flag HTTP(S) responses that deliver BUSMASTER files (.bm extension with "BUSMASTER" content) — but this is a file-inspection heuristic, not a true network indicator. Network IDS will not be effective against a user-initiated local file open. Organizations should instead rely on endpoint detection and file-scanning tools.

Elastic Detection

// Detect crashes of Wireshark / tshark processes (Windows)
// Requires Windows Defender or Sysmon providing process termination events.
any where process.name in ("wireshark.exe", "tshark.exe", "dumpcap.exe")
    and event.action in ("process_terminated", "process_exit")
    and exit_code in (1, 2, 3, 0xC0000409, 0xC0000005)

// Alternative: Detect rapidly repeated Wireshark launches (crash-loop pattern)
sequence by process.name with maxspan=5m
  [process where process.name in ("wireshark.exe", "tshark.exe") and event.action == "process_started"]
  [process where process.name in ("wireshark.exe", "tshark.exe") and event.action == "process_started"]
  [process where process.name in ("wireshark.exe", "tshark.exe") and event.action == "process_started"]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where Image IN ("*\\wireshark.exe", "*\\tshark.exe", "*\\dumpcap.exe")
| lookup cve_lookup CVE AS "CVE-2026-76926" OUTPUT description
| stats count as process_launch_count by host, Image, _time
| where process_launch_count > 3
| table _time, host, Image, process_launch_count

// Alternative: Sysmon process termination events
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=5
| where Image IN ("*\\wireshark.exe", "*\\tshark.exe", "*\\dumpcap.exe")
| rex field=CommandLine "(?<filename>\S+\.(bm|txt))"
| where isnotnull(filename)
| stats count by host, Image, filename
| where count > 2
| table host, Image, filename, count

Wazuh OSSEC Rule

<group name="wireshark,">
  <rule id="769260" level="6">
    <if_sid>550</if_sid>
    <field name="win.eventdata.image">wireshark\.exe|tshark\.exe|dumpcap\.exe</field>
    <field name="win.eventdata.eventID">^4688$</field>
    <description>Wireshark process launched - potential CVE-2026-76926 target (verify BUSMASTER file source)</description>
    <group>wireshark,cve,2026-76926,</group>
  </rule>

  <rule id="769261" level="10">
    <if_sid>769260</if_sid>
    <field name="win.eventdata.commandLine">\.(bm|txt)$</field>
    <description>Wireshark launched with BUSMASTER (.bm/.txt) file argument - verify source file integrity</description>
    <group>wireshark,cve,2026-76926,</group>
  </rule>

  <rule id="769262" level="8">
    <if_sid>550</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i)wireshark\.exe|tshark\.exe|dumpcap\.exe</field>
    <description>Frequent Wireshark crashes detected - possible CVE-2026-76926 DoS</description>
    <group>wireshark,cve,2026-76926,</group>
  </rule>

  <!-- Log-based rule for Linux/macOS (syslog) -->
  <rule id="769263" level="8">
    <if_sid>1002</if_sid>
    <match>wireshark.+Assertion|tshark.+Assertion|wireshark.+FATAL|tshark.+FATAL</match>
    <description>Wireshark assertion failure - possible CVE-2026-76926 exploit attempt</description>
    <group>wireshark,cve,2026-76926,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (NVD and Debian) confirm that a fix is available in the respective upgrade versions.

Immediate Mitigations (before patching):

1. Restrict BUSMASTER file access: If your organization does not do automotive/CAN analysis, consider disabling or removing the BUSMASTER dissector plugin if build configuration permits (typically via --disable-busmaster or removing the busmaster.lua/plugin from the plugins directory).
2. File hygiene policies: Instruct users not to open BUSMASTER (.bm, .txt from unknown sources) files received via email, instant messaging, or downloaded from untrusted sites.
3. Sandboxing: Run Wireshark in a sandboxed environment (e.g., Windows Sandbox, Firejail on Linux, or a dedicated VM) when handling files from external sources.
4. Backup current captures: Since the crash aborts the process, ensure users save active captures frequently to avoid data loss.

Patch / Upgrade Steps:

1. Upgrade to Wireshark 4.6.8 or later (for the 4.6 branch) or 4.4.19 or later (for the 4.4 branch).
2. Distribution-specific instructions:
   • Windows: Download from the official Wireshark site (https://www.wireshark.org/download.html) or use the built-in updater.
   • Debian/Ubuntu: sudo apt update && sudo apt upgrade wireshark — verify version ≥ 4.4.19 or ≥ 4.6.8.
   • RedHat/Fedora: sudo dnf update wireshark-cli wireshark.
   • macOS (Homebrew): brew upgrade wireshark.
3. If using a package manager with Wireshark bundled (e.g., Kali, Parrot), update via the distribution channels.
4. Verify no other tooling relies on the vulnerable parser (e.g., tshark scripting pipelines) and update those dependencies.

Long-Term Hardening:

1. Enable auto-updates for Wireshark; the Wireshark project frequently patches parser DoS issues. Subscribe to the Wireshark security announcements list.
2. Review plugin/dissector inventory — disable any parsers not required by your workflow (tshark -G plugins to list, then configure build or use --disable-plugin flags).
3. Employ a file-scanning layer (e.g., ClamAV, custom YARA rules, or a dedicated malware sandbox) on email gateways for incoming .bm/.txt BUSMASTER files.
4. Use application allowlisting (Windows AppLocker / Linux seccomp) to restrict Wireshark execution to trusted users only.
5. Monitor the Wireshark security page (see references) for future parser fixes and retired ad-hoc rumors.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-76926 — Official CVE record with CVSS 3.1 vector, CWE-617, and vendor description.
2. Wireshark Security Advisories: https://www.wireshark.org/security/ — Official Wireshark security announcement page; refer to the current release notes for Wireshark 4.6.8 and 4.4.19 for the specific fix.
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-76926 — Debian distribution CVE tracking page confirming vulnerable and fixed package versions.
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76926 — Canonical CVE metadata.
5. CWE-617 Reference: https://cwe.mitre.org/data/definitions/617.html — Reachable Assertion weakness description.

Threat Actor Activity: As of the writing of this report, no known threat actor campaigns or exploit-in-the-wild evidence for this CVE has been observed. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score (0.00178) and percentile ranking (7.4%) indicate a low probability of exploitation in the near to medium term. However, the public PoC indicator and the relative ease of crafting malformed parser-input files for this class of vulnerability suggest that the risk is not zero — monitor Wireshark parser-related crashes in your environment and apply the patch promptly.