CVE-2026-76879: C12.22 Protocol Dissector DoS Vulnerability

CVE-2026-76879 Overview

CVE-2026-76879 is a denial-of-service vulnerability in the Wireshark C12.22 protocol dissector. Attackers can crash Wireshark by delivering a malformed C12.22 packet to a target that captures or analyzes network traffic. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The Wireshark Foundation published advisory WNPA-SEC-2026-89 describing the issue, which is tracked as a stack-based buffer overflow under [CWE-121]. Exploitation requires no authentication and no user interaction beyond processing the malicious traffic.

Critical Impact
A remote, unauthenticated attacker can crash Wireshark on any host processing attacker-controlled C12.22 traffic, disrupting network monitoring and incident response workflows.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Any tooling that embeds the affected Wireshark dissector libraries (for example tshark, dumpcap workflows using the C12.22 dissector)

Discovery Timeline

2026-08-19 - CVE-2026-76879 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76879

Vulnerability Analysis

The vulnerability resides in the ANSI C12.22 protocol dissector shipped with Wireshark. C12.22 is a transport protocol used to convey meter data across ANSI C12-based smart metering networks. When the dissector parses a crafted C12.22 packet, it writes past the bounds of a stack buffer, corrupting the call frame and crashing the process. The advisory WNPA-SEC-2026-89 classifies the defect as a stack-based buffer overflow [CWE-121] producing a denial-of-service condition. Availability is the sole impact, with no confidentiality or integrity consequences reported.

Root Cause

The defect stems from improper bounds validation while decoding fields inside a C12.22 protocol data unit. The dissector trusts a length or offset value taken from the packet and copies data into a fixed-size stack buffer without verifying that the source length fits the destination. Malformed inputs therefore drive an out-of-bounds stack write. Consult the GitLab Wireshark Work Item for the referenced source-code region and patch discussion.

Attack Vector

An attacker delivers a malformed C12.22 frame that a Wireshark user or automated capture pipeline dissects. Common delivery paths include injecting the frame onto a monitored network segment, presenting a hostile pcap file to an analyst, or feeding traffic to an automated tshark workflow. Because C12.22 dissection is enabled by default, no configuration change on the target is required. Successful exploitation crashes the analyzer process and interrupts monitoring.

No public proof-of-concept code was available at the time of this article. See the Wireshark Security Advisory WNPA-SEC-2026-89 for the vendor's technical description.

Detection Methods for CVE-2026-76879

Indicators of Compromise

Repeated unexpected crashes of wireshark, tshark, or embedded dissector processes on analyst workstations or capture servers.
Presence of pcap or pcapng files containing C12.22 frames sourced from untrusted origins.
Crash dumps referencing the C12.22 dissector call path within Wireshark's epan library.

Detection Strategies

Inventory Wireshark installations across analyst endpoints and network sensors, and flag any version in the affected 4.4.x or 4.6.x ranges.
Alert on process termination or unexpected exit codes for wireshark.exe, tshark.exe, and their Linux and macOS equivalents.
Inspect capture files handled by shared triage pipelines for C12.22 traffic (UDP or TCP port 1153) originating from unexpected hosts.

Monitoring Recommendations

Forward endpoint process and crash telemetry to a centralized data lake for correlation with Wireshark version data.
Monitor smart-metering and operational-technology network segments for anomalous C12.22 flows toward analyst subnets.
Track upstream Wireshark advisories at wireshark.org/security for related dissector regressions.

How to Mitigate CVE-2026-76879

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.7 in the 4.6.x branch or above 4.4.18 in the 4.4.x branch as published in WNPA-SEC-2026-89.
Restrict analyst workstations from opening pcap files received from untrusted sources until patched.
Isolate automated capture pipelines that dissect live traffic from exposure to untrusted network segments.

Patch Information

The Wireshark Foundation addressed the flaw in updates referenced by advisory WNPA-SEC-2026-89. Review the Wireshark Security Advisory WNPA-SEC-2026-89 and the GitLab Wireshark Work Item for the specific commit and release identifiers, then deploy the corresponding vendor build across all analyst systems and capture appliances.

Workarounds

Disable the C12.22 dissector in Wireshark preferences under Analyze > Enabled Protocols until the patched build is deployed.
Use tshark with an explicit --disable-protocol c1222 flag when processing untrusted capture files.
Perform triage of untrusted pcap files inside an isolated virtual machine to contain any crash impact.

bash

# Disable the C12.22 dissector when processing untrusted captures
tshark --disable-protocol c1222 -r suspect_capture.pcapng

# Verify installed Wireshark version against the advisory ranges
wireshark --version | head -n 1