CVE-2026-76917 Overview
CVE-2026-76917 is a denial-of-service vulnerability in the Wireshark Bluetooth Audio/Video Remote Control Profile (AVRCP) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Processing a malformed AVRCP packet capture causes the dissector to crash, terminating the Wireshark process. The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow and requires local user interaction to trigger.
Critical Impact
An attacker can crash Wireshark by delivering a crafted packet capture file or live packet stream containing malformed AVRCP data, disrupting network analysis workflows.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Bluetooth AVRCP protocol dissector component
Discovery Timeline
- 2026-08-19 - CVE-2026-76917 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76917
Vulnerability Analysis
The vulnerability resides in the Bluetooth AVRCP protocol dissector shipped with Wireshark. AVRCP is used by Bluetooth devices to exchange remote-control commands for audio and video functions. When Wireshark parses AVRCP packet fields, the dissector mishandles memory operations and triggers a heap-based buffer overflow condition ([CWE-122]).
The resulting corruption crashes the Wireshark process, producing a denial-of-service condition. The vulnerability does not expose confidentiality or integrity impacts. Exploitation requires a local user to open a malicious capture file or process live traffic containing crafted AVRCP frames.
The Wireshark Security Advisory WNPA-SEC-2026-91 documents the crash condition, and GitLab Work Item #21488 tracks the underlying defect and fix.
Root Cause
The root cause is a heap memory handling error inside the AVRCP dissector code path. The dissector fails to correctly validate field boundaries before performing buffer operations on attacker-controlled data. Malformed length or offset values in AVRCP protocol data units drive the dissector past allocated buffer bounds, corrupting heap metadata.
Attack Vector
An attacker delivers a crafted .pcap or .pcapng capture file to a Wireshark user, or injects crafted AVRCP frames into a network segment being captured live. When the analyst opens the file or performs live analysis, the dissector processes the malformed AVRCP data and crashes. The attack requires user interaction and produces only availability impact against the analyst workstation.
No public exploit code or proof of concept has been released for this vulnerability. See the Wireshark security advisory for authoritative technical details on the affected code path.
Detection Methods for CVE-2026-76917
Indicators of Compromise
- Unexpected termination of the wireshark or tshark process while opening capture files
- Crash dumps or Windows Error Reporting entries referencing the Wireshark AVRCP dissector module
- Receipt of unsolicited .pcap or .pcapng files containing Bluetooth AVRCP traffic from untrusted sources
Detection Strategies
- Inventory endpoints for Wireshark installations at versions 4.6.0–4.6.7 and 4.4.0–4.4.18 using software asset management data
- Monitor process telemetry for repeated Wireshark or tshark crashes correlated with capture file access
- Inspect email and file-share gateways for capture files delivered from external senders to analyst mailboxes
Monitoring Recommendations
- Alert on Wireshark process crash events on analyst workstations and SOC hosts
- Track file downloads with .pcap and .pcapng extensions originating from untrusted sources
- Review endpoint logs for Wireshark launches immediately preceding process termination events
How to Mitigate CVE-2026-76917
Immediate Actions Required
- Upgrade Wireshark to a patched release outside the affected 4.6.0–4.6.7 and 4.4.0–4.4.18 ranges
- Instruct analysts to avoid opening capture files received from untrusted sources until patching is complete
- Isolate analysis of untrusted captures to non-production, snapshot-based virtual machines
Patch Information
Refer to the Wireshark Security Advisory WNPA-SEC-2026-91 for the official fixed release information. The corresponding upstream fix is tracked in GitLab Work Item #21488. Apply the vendor-supplied update through package managers or the official Wireshark download channels.
Workarounds
- Disable the Bluetooth AVRCP dissector in Wireshark preferences via Analyze > Enabled Protocols and unchecking BT AVRCP
- Use tshark with the --disable-protocol btavrcp flag when processing capture files that may contain AVRCP data
- Restrict Wireshark usage to trusted capture sources until patched versions are deployed
# Disable the AVRCP dissector when running tshark on untrusted captures
tshark --disable-protocol btavrcp -r untrusted_capture.pcapng
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
