CVE-2026-76919 Overview
CVE-2026-76919 is a denial of service vulnerability in the Wireshark Enhanced Security Services (ESS) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. An attacker can trigger a crash in the dissector by injecting a crafted packet onto the network or by convincing a user to open a malicious capture file. Successful exploitation causes the Wireshark process to terminate, disrupting network analysis workflows. The underlying weakness maps to [CWE-457] Use of Uninitialized Variable within the ESS dissector code path.
Critical Impact
Remote attackers can crash Wireshark by delivering a malformed ESS packet or capture file, interrupting incident response and network forensics activity.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Deployments using the ESS protocol dissector
Discovery Timeline
- 2026-08-19 - CVE-2026-76919 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76919
Vulnerability Analysis
The defect resides in the Wireshark ESS protocol dissector. When parsing certain ESS protocol fields, the dissector references memory that was never initialized. Dissectors run automatically against every packet matching the protocol heuristics, so exploitation requires no user interaction beyond capturing traffic.
The crash produces a denial of service condition against the analyst workstation running Wireshark or tshark. Confidentiality and integrity remain unaffected, but availability of the analysis tool is disrupted for the duration of the crash. Refer to the Wireshark Security Advisory 2026-86 for the vendor's technical description.
Root Cause
The root cause is classified as [CWE-457] Use of Uninitialized Variable. The ESS dissector reads a variable before assigning a defined value along all code paths. When the variable holds unpredictable stack contents, subsequent operations dereference invalid data and abort the process. The GitLab work item 21467 tracks the code-level fix.
Attack Vector
Attack delivery is network-based and requires no privileges or user interaction. An attacker can inject a crafted ESS packet on a monitored network segment, and the running Wireshark or tshark instance will parse and crash on it. Alternatively, a malicious .pcap or .pcapng file distributed to an analyst triggers the same condition when opened. Live capture on shared infrastructure represents the most practical exposure.
Detection Methods for CVE-2026-76919
Indicators of Compromise
- Unexpected termination of Wireshark or tshark processes on analyst workstations during live capture
- Presence of unsolicited or malformed ESS protocol traffic on monitored segments
- Capture files received from untrusted sources that consistently crash the dissector on load
Detection Strategies
- Monitor endpoint telemetry for repeated crashes of wireshark.exe, wireshark, or tshark binaries followed by rapid restart attempts
- Alert on inbound ESS-tagged traffic from unexpected sources or on segments where ESS is not part of the baseline
- Correlate crash events with recent capture-file downloads or email attachments containing .pcap or .pcapng files
Monitoring Recommendations
- Enable process crash and application error logging on workstations used for packet analysis
- Ingest Wireshark version inventory into asset management to identify hosts running affected 4.4.x and 4.6.x releases
- Track distribution channels for capture files and flag samples that fail to open in patched builds
How to Mitigate CVE-2026-76919
Immediate Actions Required
- Upgrade Wireshark to a fixed release outside the 4.6.0–4.6.7 and 4.4.0–4.4.18 ranges as published by the Wireshark Foundation
- Avoid opening capture files received from untrusted or unverified sources until patching is complete
- Restrict live packet capture on untrusted network segments where crafted ESS traffic could be introduced
Patch Information
The Wireshark project has issued a fix referenced in Wireshark Security Advisory 2026-86 and tracked in GitLab work item 21467. Apply the latest patched release from the official Wireshark download channels.
Workarounds
- Disable the ESS dissector in Wireshark preferences under Analyze > Enabled Protocols until upgrade is possible
- Use tshark with a capture filter that excludes ESS traffic when running unattended capture pipelines
- Perform capture-file triage inside an isolated virtual machine to contain crash impact
# Disable the ESS dissector from the command line
tshark -o "disabled_protocols:ess" -r suspicious_capture.pcapng
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
