CVE-2026-76891 Overview
CVE-2026-76891 is a denial-of-service vulnerability affecting the sharkd daemon in Wireshark. The flaw allows a crash condition when sharkd processes untrusted input, resulting in service disruption. The issue is classified under [CWE-825: Expired Pointer Dereference].
The vulnerability affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Exploitation requires user interaction and has high attack complexity, limiting real-world abuse. No confidentiality or integrity impact exists, only availability loss through the crash of the sharkd process.
Critical Impact
Successful exploitation crashes the sharkd daemon, disrupting analysis workflows that depend on it. The vulnerability has an EPSS probability of 0.174% (percentile 7.217), reflecting low expected exploitation activity.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- The sharkd daemon component shipped with affected Wireshark builds
Discovery Timeline
- 2026-08-19 - CVE-2026-76891 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76891
Vulnerability Analysis
The vulnerability resides in sharkd, the Wireshark daemon that exposes packet-analysis functionality over a control channel for external clients. sharkd accepts JSON requests and returns dissection results, making it a common backend for scripted or GUI-based analysis tools.
The defect maps to [CWE-825], meaning the program dereferences a pointer that no longer references a valid memory object. When sharkd processes a crafted request or capture, this stale pointer access triggers a crash. The result is a loss of availability for any workflow relying on the daemon.
Because the impact is limited to the daemon process, no code execution or data disclosure occurs. Refer to the Wireshark Security Advisory WNPA-SEC-2026-64 for the vendor's detailed technical description.
Root Cause
The root cause is an expired pointer dereference within sharkd request handling logic. Object lifetime management fails under specific input sequences, leaving a reference that points to freed or invalidated memory. When the daemon subsequently accesses that pointer, the process terminates.
Attack Vector
Exploitation occurs over the network and requires user interaction, such as an analyst opening a crafted capture or issuing a request to a sharkd instance processing attacker-controlled data. Attack complexity is high, and no privileges are required. See the GitLab Wireshark work item for engineering details.
No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been reported.
Detection Methods for CVE-2026-76891
Indicators of Compromise
- Unexpected termination of the sharkd process on hosts running Wireshark 4.6.0–4.6.7 or 4.4.0–4.4.18.
- Core dumps or crash reports referencing sharkd following ingestion of untrusted capture files.
- Repeated sharkd restarts within short intervals on analysis workstations or automation pipelines.
Detection Strategies
- Monitor process exit codes and crash logs for sharkd invocations across analyst endpoints.
- Track Wireshark package versions across the environment and flag hosts running affected builds.
- Correlate sharkd crashes with the source of the capture file or client request to identify suspicious inputs.
Monitoring Recommendations
- Forward operating-system crash telemetry (Windows Error Reporting, systemd-coredump, apport) to a central log store for review.
- Alert on sharkd termination events combined with recent file downloads or shared capture uploads.
- Audit automation systems that call sharkd and record request payloads for post-incident analysis.
How to Mitigate CVE-2026-76891
Immediate Actions Required
- Inventory endpoints and servers running Wireshark and identify installations within the affected version ranges.
- Upgrade Wireshark to a fixed release as specified in WNPA-SEC-2026-64.
- Restrict use of sharkd to trusted capture files and trusted clients until patching completes.
Patch Information
The Wireshark Foundation has published fixes as described in Wireshark Security Advisory WNPA-SEC-2026-64. Users on the 4.6.x branch and the 4.4.x branch should upgrade to the patched versions referenced in the advisory. The corresponding engineering change is tracked in the GitLab work item 21395.
Workarounds
- Avoid opening capture files from untrusted sources with vulnerable Wireshark builds.
- Disable or restrict access to sharkd on shared analysis systems until patched packages are deployed.
- Run analysis of unknown captures inside isolated virtual machines to contain crash impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
