CVE-2026-76882 Overview
CVE-2026-76882 is a denial-of-service vulnerability in the Wireshark Bluetooth Attribute Protocol (ATT) dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A crafted capture file or packet stream can trigger an out-of-bounds read [CWE-125] in the dissector, crashing the Wireshark process. The vulnerability is categorized as a local attack requiring user interaction, such as opening a malicious .pcap file or listening on an interface receiving crafted traffic.
Critical Impact
An attacker who convinces an analyst to open a crafted capture file can crash Wireshark, interrupting network analysis workflows and potentially causing loss of unsaved session data.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Bluetooth Attribute Protocol (ATT) dissector component
Discovery Timeline
- 2026-08-19 - CVE-2026-76882 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76882
Vulnerability Analysis
The vulnerability resides in the Bluetooth Attribute Protocol dissector within Wireshark. The dissector parses ATT protocol data units captured from Bluetooth Low Energy traffic. When processing a malformed ATT message, the dissector reads memory beyond an allocated buffer boundary, producing a segmentation fault that terminates the Wireshark process.
Exploitation does not disclose memory contents or permit code execution. The impact is limited to availability, matching a classic dissector crash pattern in Wireshark. Analysts working through large capture datasets lose in-progress analysis when the application terminates unexpectedly.
See the Wireshark Security Advisory WNPA-SEC-2026-73 and the GitLab Work Item #21424 for upstream tracking details.
Root Cause
The root cause is an out-of-bounds read [CWE-125] in the Bluetooth ATT dissector logic. The parser fails to validate a length or offset field before dereferencing a buffer pointer. When the derived offset exceeds the packet buffer boundary, the process reads unmapped memory and crashes.
Attack Vector
The attack requires local access and user interaction. An attacker delivers a crafted packet capture file to the target analyst, who opens it in Wireshark. Alternatively, the crafted frames can be injected onto a Bluetooth interface being monitored live. No authentication is required, but the analyst must actively load or capture the malicious data for the crash to occur.
No verified public exploit code is available. The vulnerability mechanism is documented in the upstream Wireshark advisory linked above rather than reproduced here.
Detection Methods for CVE-2026-76882
Indicators of Compromise
- Unexpected termination of the wireshark or tshark process shortly after opening a capture file or starting a Bluetooth capture session.
- Presence of core dump files or crash reports referencing the packet-btatt dissector module.
- Receipt of unsolicited .pcap or .pcapng files containing Bluetooth ATT frames from untrusted sources.
Detection Strategies
- Inventory endpoints for installed Wireshark versions and flag any instance in the 4.6.0–4.6.7 or 4.4.0–4.4.18 ranges.
- Monitor crash telemetry on analyst workstations for repeated Wireshark faults, which may indicate a delivered malicious capture.
- Inspect email and file-sharing gateways for capture files originating from external senders and quarantine them for review.
Monitoring Recommendations
- Enable application crash reporting on analyst workstations and forward events to a central SIEM for correlation.
- Track process termination events for wireshark.exe, Wireshark, and tshark alongside recently accessed file paths.
- Alert on downloads of .pcap, .pcapng, and .cap files from untrusted domains or unknown external senders.
How to Mitigate CVE-2026-76882
Immediate Actions Required
- Upgrade Wireshark to a fixed release outside the affected 4.6.x and 4.4.x ranges as identified in WNPA-SEC-2026-73.
- Instruct analysts to refuse capture files from untrusted or unverified sources until patching is complete.
- Perform Wireshark analysis of untrusted captures inside an isolated virtual machine or sandbox host.
Patch Information
Refer to the official Wireshark Security Advisory WNPA-SEC-2026-73 for the fixed version numbers and download locations. The upstream fix is tracked in GitLab Work Item #21424.
Workarounds
- Disable the Bluetooth ATT dissector in the Wireshark preferences under Analyze > Enabled Protocols by unchecking BT ATT when analyzing untrusted captures.
- Use tshark with the --disable-protocol btatt flag to prevent the vulnerable dissector from processing frames.
- Restrict Wireshark usage on production systems to trusted capture files only.
# Configuration example: disable the vulnerable dissector when using tshark
tshark --disable-protocol btatt -r suspicious_capture.pcapng
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
