CVE-2026-76888: RDP Protocol Dissector DoS Vulnerability

CVE-2026-76888 Overview

CVE-2026-76888 is a denial-of-service vulnerability in the Wireshark Remote Desktop Protocol (RDP) dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A malformed RDP packet processed by the dissector causes the application to crash, disrupting live capture and analysis workflows. The issue is tracked under Wireshark Security Advisory WNPA-SEC-2026-67 and mapped to [CWE-122] heap-based buffer corruption.

Critical Impact
An attacker who injects or delivers a crafted RDP packet to a Wireshark user can crash the dissector, terminating capture sessions and disrupting network analysis.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Deployments using the RDP protocol dissector for live or offline packet analysis

Discovery Timeline

2026-08-19 - CVE-2026-76888 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76888

Vulnerability Analysis

The vulnerability resides in the Wireshark RDP protocol dissector. When the dissector parses a malformed RDP frame, it triggers a heap-based memory corruption condition classified under [CWE-122]. The result is an application crash rather than code execution, producing a denial-of-service outcome limited to the analyst workstation running Wireshark.

Exploitation requires that a user open a crafted capture file or that Wireshark process the malicious packet during a live capture. The attack requires user interaction and does not compromise confidentiality or integrity, but it terminates the analyst's session and interrupts monitoring workflows. Repeated delivery of malicious RDP frames on a monitored segment can render Wireshark unusable for that traffic.

Root Cause

The root cause is improper bounds handling within the RDP dissector when interpreting fields from an attacker-controlled packet. The dissector allocates or accesses a heap buffer using values derived from untrusted input, leading to corruption when those values exceed expected ranges. Wireshark's advisory documents the crash and the corresponding fix in the RDP dissector source. See the GitLab Wireshark Work Item for developer discussion.

Attack Vector

An attacker delivers a crafted RDP packet across the network segment Wireshark is monitoring, or supplies a malicious .pcap or .pcapng file to the analyst. When the RDP dissector processes the packet, Wireshark crashes. No authentication is required, but attack complexity is high and user interaction is required for the file-based path.

No verified public exploit or proof-of-concept code is available. Refer to the Wireshark Security Advisory WNPA-SEC-2026-67 for technical details.

Detection Methods for CVE-2026-76888

Indicators of Compromise

Unexpected Wireshark or tshark process termination while analyzing RDP traffic on TCP port 3389
Crash dumps or Windows Application Event Log entries citing wireshark.exe or tshark.exe faulting modules related to protocol dissection
Capture files containing malformed RDP frames that consistently reproduce the crash on affected versions

Detection Strategies

Inventory endpoints running Wireshark and identify versions in the 4.4.0-4.4.18 or 4.6.0-4.6.7 ranges
Alert on repeated crash events for wireshark.exe or tshark.exe on analyst workstations
Review packet captures shared with SOC analysts for anomalous RDP frames before opening them on affected versions

Monitoring Recommendations

Log Wireshark process lifecycle events on analyst and incident response workstations
Monitor RDP traffic on port 3389 for malformed frames using intrusion detection signatures once vendor rules are published
Track software version telemetry to confirm remediation coverage across the environment

How to Mitigate CVE-2026-76888

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the 4.4.0-4.4.18 and 4.6.0-4.6.7 ranges as documented in WNPA-SEC-2026-67
Avoid opening untrusted .pcap or .pcapng files on affected Wireshark installations until patched
Restrict live captures on untrusted network segments while the vulnerable dissector remains loaded

Patch Information

The Wireshark project has published a fix referenced in the GitLab Wireshark Work Item 21396. Administrators should deploy the updated Wireshark package through their standard software distribution channels and validate the installed version on each analyst workstation.

Workarounds

Disable the RDP dissector in Wireshark via Analyze > Enabled Protocols by unchecking RDP until an upgrade is possible
Use tshark with --disable-protocol rdp when processing capture files from untrusted sources
Segregate packet analysis to isolated workstations that cannot disrupt production monitoring if a crash occurs

bash

# Disable the RDP dissector when running tshark on untrusted captures
tshark -r suspicious.pcapng --disable-protocol rdp

# Verify installed Wireshark version against affected ranges
wireshark --version | head -n 1