CVE-2026-76880 Overview
CVE-2026-76880 is a denial of service vulnerability in the Wireshark Radio Resource Control (RRC) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A remote attacker can trigger a dissector crash by injecting a malformed packet into the network or by convincing a user to open a crafted capture file. Successful exploitation halts the analysis process and disrupts network monitoring workflows. The underlying weakness is classified as an out-of-bounds write [CWE-787]. No authentication or user interaction is required for the network-based attack path.
Critical Impact
Remote attackers can crash Wireshark by delivering a malformed RRC packet, disrupting packet capture and analysis with no authentication required.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Systems using the affected RRC protocol dissector for live capture or offline analysis
Discovery Timeline
- 2026-08-19 - CVE-2026-76880 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76880
Vulnerability Analysis
The vulnerability resides in the RRC protocol dissector, a component Wireshark uses to parse cellular signaling traffic. Processing a malformed RRC message causes the dissector to write outside allocated bounds, terminating the Wireshark process. The impact is limited to availability. The vulnerability does not expose captured data confidentiality or permit tampering with capture contents. Loss of the dissector during live capture forces analysts to restart sessions and can interrupt ongoing incident response and troubleshooting activities. For full technical context, see the Wireshark Security Advisory WNPA-SEC-2026-88 and the corresponding GitLab Work Item #21478.
Root Cause
The root cause is an out-of-bounds write [CWE-787] within the RRC dissector parsing logic. The dissector fails to validate a length or index field before writing to memory, corrupting adjacent state and crashing the process. Because Wireshark automatically invokes dissectors as packets are read, no user interaction beyond opening a capture is required to reach the vulnerable code path.
Attack Vector
Exploitation requires that a target instance of Wireshark process an attacker-controlled RRC message. Two practical delivery methods exist. First, an attacker on the same network segment as a live capture can transmit a crafted packet that Wireshark ingests. Second, an attacker can distribute a malicious pcap or pcapng file, which crashes the dissector when the analyst opens it. The vulnerability yields only denial of service; no code execution capability is documented.
No verified proof-of-concept code is publicly available. Refer to the Wireshark Security Advisory WNPA-SEC-2026-88 for reproduction details.
Detection Methods for CVE-2026-76880
Indicators of Compromise
- Unexpected termination of the wireshark or tshark process during live capture or file analysis
- Crash dumps or core files referencing the RRC dissector in Wireshark modules
- Presence of unsolicited RRC-encapsulated traffic on network segments that do not carry cellular signaling
Detection Strategies
- Inventory endpoints and analyst workstations running Wireshark 4.6.0-4.6.7 or 4.4.0-4.4.18 using software asset management tools
- Monitor host telemetry for repeated Wireshark or tshark process crashes correlated with capture file access or packet ingestion
- Inspect suspicious pcap and pcapng files in sandboxed environments before opening on analyst workstations
Monitoring Recommendations
- Forward endpoint process termination events to a centralized logging platform for correlation across analyst systems
- Alert on transfers of capture files from untrusted sources into shared analysis folders
- Track version drift on Wireshark installations to identify hosts that remain on vulnerable releases
How to Mitigate CVE-2026-76880
Immediate Actions Required
- Upgrade Wireshark to a fixed release outside the vulnerable ranges as identified in WNPA-SEC-2026-88
- Avoid opening untrusted capture files on production analyst workstations until patches are applied
- Restrict live captures on segments where untrusted RRC traffic could be injected
Patch Information
The Wireshark Foundation has addressed the RRC dissector crash. Consult the Wireshark Security Advisory WNPA-SEC-2026-88 and GitLab Work Item #21478 for the fix commit and updated release versions. Upgrade all instances of Wireshark, tshark, and any embedded libwireshark deployments to a patched build.
Workarounds
- Disable the RRC dissector in Wireshark preferences under Analyze then Enabled Protocols when a patched version cannot be installed immediately
- Process untrusted capture files inside isolated virtual machines or containers to contain crashes
- Filter capture inputs to exclude RRC-encapsulated traffic when analyzing packets from untrusted sources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
