CVE-2026-76920: 3GPP Phone Log Parser DoS Vulnerability

CVE-2026-76920 Overview

CVE-2026-76920 is a denial-of-service vulnerability in the Wireshark 3GPP phone log file parser. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A crafted 3GPP phone log file triggers an out-of-bounds write [CWE-787], causing the parser to crash. Exploitation requires local access and user interaction, such as opening or importing a malicious capture file in Wireshark. The vulnerability does not expose data confidentiality or integrity but results in application termination and disruption of ongoing packet analysis work.

Critical Impact
Attackers can crash Wireshark by convincing an analyst to open a malicious 3GPP phone log file, disrupting incident response and network forensics workflows.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Systems using Wireshark for 3GPP phone log analysis

Discovery Timeline

2026-08-19 - CVE-2026-76920 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76920

Vulnerability Analysis

The vulnerability resides in the Wireshark dissector responsible for parsing 3GPP phone log files. When the parser processes a malformed log record, it writes data past the bounds of an allocated buffer. The out-of-bounds write corrupts adjacent memory and terminates the Wireshark process. Because the impact is limited to availability, the flaw enables a targeted denial of service against analysts and automation pipelines that ingest 3GPP capture artifacts.

Exploitation requires the victim to open the crafted file locally. The attack complexity is high because the payload must align with parser state to reach the vulnerable write path. No privileges are required on the target host, but user interaction is mandatory.

Root Cause

The defect maps to [CWE-787: Out-of-bounds Write]. The parser fails to validate the size of a field extracted from the 3GPP phone log input before writing to a fixed-size buffer. Details on the affected function and the corrective code change are tracked in the GitLab Wireshark Work Item and the Wireshark Security Advisory.

Attack Vector

The attacker delivers a malicious 3GPP phone log file through email, chat, shared drives, or a public capture repository. When the analyst opens the file in a vulnerable Wireshark build, the dissector executes the malformed record and crashes. Automated pipelines that feed capture files to tshark for triage are also affected.

See the Wireshark Security Advisory for reproduction details.

Detection Methods for CVE-2026-76920

Indicators of Compromise

Unexpected termination of wireshark or tshark processes immediately after loading a 3GPP phone log file
Operating system crash dumps referencing Wireshark modules and 3GPP dissector symbols
3GPP phone log files received from untrusted sources or with anomalous size and structure

Detection Strategies

Inventory endpoints running Wireshark and flag versions in the affected ranges (4.6.0–4.6.7, 4.4.0–4.4.18)
Correlate Wireshark process crashes with recent file-open events on .3gpp, .log, or related capture extensions
Alert on delivery of capture files from external sources to analyst workstations

Monitoring Recommendations

Forward Windows Application event log entries and Linux coredump records for Wireshark binaries to the SIEM
Track EDR telemetry for repeated Wireshark exits with non-zero status on analyst hosts
Review email and file-sharing gateway logs for inbound 3GPP capture artifacts

How to Mitigate CVE-2026-76920

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.7 or above 4.4.18 as published by the Wireshark Foundation
Instruct analysts to avoid opening 3GPP phone log files received from untrusted senders until patching is complete
Isolate capture triage to a non-production analysis host where feasible

Patch Information

Refer to the Wireshark Security Advisory wnpa-sec-2026-81 for the fixed version list and download links. Distribution package maintainers should track the GitLab Wireshark Work Item 21454 for the upstream commit reference.

Workarounds

Disable the 3GPP phone log dissector in Wireshark preferences under Analyze → Enabled Protocols until the patch is deployed
Restrict Wireshark to read only capture files sourced from trusted internal collection systems
Use tshark in a sandboxed container when triaging capture files of unknown provenance

bash

# Verify installed Wireshark version and identify vulnerable builds
wireshark --version | head -n 1
tshark --version | head -n 1

# Debian/Ubuntu: apply vendor updates once available
sudo apt update && sudo apt install --only-upgrade wireshark tshark

# Red Hat/Fedora
sudo dnf upgrade wireshark wireshark-cli