CVE-2026-76918: SSH Protocol Dissector DoS Vulnerability

CVE-2026-76918 Overview

CVE-2026-76918 is a denial-of-service vulnerability in the Wireshark SSH protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. An attacker can crash the dissector by injecting a malformed packet capture or persuading a user to open a crafted capture file. The vulnerability is classified as a heap-based buffer overflow [CWE-122] and results in process termination rather than code execution. Successful exploitation disrupts network analysis workflows and forensic investigations that depend on Wireshark for packet inspection.

Critical Impact
A malformed SSH packet or capture file crashes Wireshark, disrupting availability of packet analysis tooling on the analyst workstation.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Any distribution or appliance bundling the affected Wireshark versions

Discovery Timeline

2026-08-19 - CVE-2026-76918 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76918

Vulnerability Analysis

The vulnerability resides in the Wireshark SSH protocol dissector. When the dissector parses a malformed SSH packet, it performs an out-of-bounds write on a heap-allocated buffer. The condition causes the Wireshark process to crash and terminates any active capture or analysis session.

Exploitation requires local user interaction. A victim must open a crafted capture file or run Wireshark against a live interface receiving attacker-supplied traffic. The vulnerability does not permit code execution or information disclosure based on the published impact metrics.

The SSH dissector operates on packet data before any authentication or cryptographic verification. This means encrypted SSH sessions provide no protection against the parsing bug, because the crash occurs during protocol framing analysis.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the SSH dissector code path. The dissector fails to validate a length or offset value derived from attacker-controlled packet fields before writing to a heap buffer. Refer to the Wireshark Security Advisory WNPA-SEC-2026-85 and GitLab Work Item #21465 for the upstream fix details.

Attack Vector

Attack requires local access with user interaction. Two practical delivery paths exist. First, an attacker sends a crafted .pcap or .pcapng file to an analyst who opens it in Wireshark. Second, an attacker injects malformed SSH traffic onto a monitored network segment while an analyst runs a live capture. Both paths yield only a denial of service on the analyst workstation.

Detection Methods for CVE-2026-76918

Indicators of Compromise

Unexpected Wireshark, tshark, or dumpcap process crashes during SSH traffic analysis
Crash dumps or core files referencing the SSH dissector module
Receipt of unsolicited packet capture files from external sources purporting to contain SSH traffic

Detection Strategies

Monitor endpoint telemetry for repeated abnormal termination of wireshark.exe, tshark.exe, or their Linux and macOS equivalents
Inspect email and file-sharing gateways for inbound .pcap and .pcapng attachments delivered to security or network operations personnel
Correlate Wireshark version metadata across managed workstations to identify hosts running vulnerable 4.4.x or 4.6.x builds

Monitoring Recommendations

Log Wireshark process launches and exit codes on analyst workstations for retrospective triage
Alert on capture files opened from user download directories immediately followed by a Wireshark crash
Track patch compliance for the Wireshark package through software inventory tooling

How to Mitigate CVE-2026-76918

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the 4.4.0–4.4.18 and 4.6.0–4.6.7 ranges as identified in WNPA-SEC-2026-85
Do not open packet capture files received from untrusted or unverified sources
Restrict live capture operations on network segments exposed to untrusted traffic until analyst systems are patched

Patch Information

The Wireshark Foundation addresses the flaw in updated releases referenced by Wireshark Security Advisory WNPA-SEC-2026-85. The upstream fix is tracked in GitLab Work Item #21465. Administrators should deploy the fixed package through their standard software distribution channels and verify version output with wireshark --version or tshark --version.

Workarounds

Disable the SSH dissector through Wireshark's Analyze > Enabled Protocols menu until patching is complete
Use tshark with a display filter that excludes SSH traffic when analyzing captures from untrusted sources
Analyze suspect capture files in an isolated virtual machine to contain the impact of a crash

bash

# Verify installed Wireshark version
wireshark --version

# Disable the SSH dissector at the command line for tshark
tshark --disable-protocol ssh -r suspect.pcap