CVE-2026-76890: Wireshark sharkd DoS Vulnerability

CVE-2026-76890 Overview

CVE-2026-76890 is a denial-of-service vulnerability in sharkd, a component of the Wireshark network protocol analyzer. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A network-based attacker can trigger a crash in the sharkd process, producing a limited availability impact on affected systems. The weakness is categorized under [CWE-825: Expired Pointer Dereference]. Exploitation requires user interaction and has high attack complexity, which constrains real-world exploitability. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Successful exploitation crashes the sharkd process, disrupting analysis workflows that depend on it but not exposing confidentiality or integrity.

Affected Products

Wireshark 4.6.0 through 4.6.7 (sharkd component)
Wireshark 4.4.0 through 4.4.18 (sharkd component)
Downstream distributions bundling the affected Wireshark releases

Discovery Timeline

2026-08-19 - CVE-2026-76890 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76890

Vulnerability Analysis

The vulnerability resides in sharkd, the Wireshark daemon that provides a JSON-based interface for programmatic packet analysis. Processing a crafted input causes sharkd to dereference a pointer that has already been freed or is otherwise no longer valid. The result is an abnormal termination of the process.

The crash impacts availability only. There is no indication that memory contents leak to the caller or that control flow can be redirected to attacker-supplied code. The Wireshark project tracks the underlying defect under work item 21399 and describes it in advisory WNPA-SEC-2026-65.

Root Cause

The defect is an expired pointer dereference [CWE-825]. sharkd retains a reference to a memory object beyond that object's valid lifetime and later dereferences the stale pointer while handling analysis input. The condition is deterministic once the triggering input is supplied but requires specific sequencing to reach.

Attack Vector

The attack vector is network-adjacent through crafted analysis input consumed by sharkd. User interaction is required, since an operator must load or process the malicious data. Attack complexity is high because reliable triggering depends on precise state within the daemon. Successful exploitation terminates the sharkd process, interrupting active analysis sessions.

No verified exploit code is publicly available. Refer to the Wireshark Security Advisory WNPA-SEC-2026-65 and GitLab Work Item #21399 for authoritative technical details.

Detection Methods for CVE-2026-76890

Indicators of Compromise

Unexpected termination or repeated restarts of the sharkd process on analyst workstations or capture servers.
Core dumps or crash reports referencing sharkd with faults during input parsing.
Untrusted .pcap, .pcapng, or JSON request payloads delivered to systems running sharkd.

Detection Strategies

Monitor process telemetry for abnormal exit codes from sharkd following the ingestion of external capture files.
Track file provenance for packet captures processed by analysts and flag files sourced from untrusted origins.
Alert on newly created crash artifacts (core.*, Windows Error Reporting entries) associated with Wireshark binaries.

Monitoring Recommendations

Inventory endpoints and analysis servers running Wireshark and record installed versions to identify vulnerable hosts.
Log invocations of sharkd and correlate them with the source of processed capture files.
Review endpoint detection telemetry for repeated crash-loop patterns in sharkd that could indicate targeted probing.

How to Mitigate CVE-2026-76890

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the vulnerable 4.6.0–4.6.7 and 4.4.0–4.4.18 ranges as identified in advisory WNPA-SEC-2026-65.
Restrict sharkd usage to trusted capture files and disable automated ingestion of externally supplied inputs.
Communicate the risk to analyst teams so untrusted .pcap and .pcapng files are handled in isolated environments.

Patch Information

The Wireshark Foundation addresses the defect in updated 4.6.x and 4.4.x releases. Consult the Wireshark Security Advisory WNPA-SEC-2026-65 for the fixed version numbers and the associated GitLab Work Item #21399 for the source-level fix.

Workarounds

Avoid running sharkd against capture files or JSON requests obtained from untrusted sources until patched.
Process suspicious captures inside a disposable virtual machine or container to contain any crash impact.
Remove or disable sharkd on systems that do not require programmatic Wireshark access.

bash

# Verify installed Wireshark version and remove sharkd if unused
wireshark --version
dpkg -l | grep -i wireshark   # Debian/Ubuntu
rpm -qa | grep -i wireshark   # RHEL/Fedora

# Example: restrict execution of sharkd to authorized users only
sudo chown root:wireshark /usr/bin/sharkd
sudo chmod 750 /usr/bin/sharkd