CVE-2026-76922: Bluetooth BR/EDR DOS Vulnerability

CVE-2026-76922 Overview

CVE-2026-76922 is a denial-of-service vulnerability in the Wireshark Bluetooth BR/EDR Frequency Hop Synchronization (FHS) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Processing a crafted capture file or live packet stream triggers a null pointer dereference [CWE-476] in the dissector, causing the application to crash. Exploitation requires local user interaction, such as opening a malicious .pcap file, and does not lead to code execution or data disclosure. The issue is tracked in Wireshark Security Advisory WNPA-SEC-2026-80 and GitLab Work Item #21452.

Critical Impact
A malformed Bluetooth BR/EDR FHS packet forces Wireshark to crash, interrupting active capture sessions and forensic analysis workflows.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Bluetooth BR/EDR FHS protocol dissector component

Discovery Timeline

2026-08-19 - CVE-2026-76922 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76922

Vulnerability Analysis

The vulnerability resides in the Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) Frequency Hop Synchronization (FHS) protocol dissector shipped with Wireshark. When the dissector parses a malformed FHS packet, it dereferences a null pointer and terminates the Wireshark or tshark process. The impact is limited to availability. Confidentiality and integrity are not affected, and no privilege escalation is possible. Because the attack vector is local and requires user interaction, an attacker must convince an analyst to open a crafted capture file or feed the malformed traffic into a live capture session.

The vulnerability class, null pointer dereference [CWE-476], typically stems from missing checks on the return value of a lookup or allocation routine before the pointer is used. In dissector code, this often occurs when a subtree, sub-dissector handle, or protocol data structure is expected to exist for a given packet field but the crafted input causes the lookup to fail.

Root Cause

The root cause is insufficient validation within the FHS dissector when handling unexpected or malformed field values in Bluetooth BR/EDR frames. See the Wireshark advisory and the upstream GitLab issue #21452 for the specific code path and fix commit.

Attack Vector

Exploitation requires an analyst to open a malicious capture file, load traffic from a compromised source, or run a live capture that includes attacker-controlled Bluetooth BR/EDR FHS frames. The crash terminates the dissection session and may cause loss of unsaved capture data. No network-based remote exploitation is possible without user interaction.

No verified proof-of-concept code is publicly available.
Refer to WNPA-SEC-2026-80 and GitLab work item #21452 for
the technical fix details and reproducer information.

Detection Methods for CVE-2026-76922

Indicators of Compromise

Unexpected termination of wireshark or tshark processes while dissecting Bluetooth traffic
Presence of untrusted .pcap or .pcapng files containing Bluetooth BR/EDR FHS frames from unverified sources
Crash reports or core dumps referencing the FHS dissector code path

Detection Strategies

Inventory endpoints and analyst workstations running Wireshark 4.6.0–4.6.7 or 4.4.0–4.4.18 using software asset management data
Alert on process crashes for wireshark.exe, tshark.exe, and their Linux and macOS equivalents
Flag ingestion of capture files from external or untrusted sources into forensic analysis environments

Monitoring Recommendations

Forward Wireshark and tshark process termination events to a central log store for correlation
Track file provenance for capture files handed to analysts, including email attachments and shared drives
Review Bluetooth packet captures in an isolated analysis sandbox before opening on production workstations

How to Mitigate CVE-2026-76922

Immediate Actions Required

Upgrade Wireshark to a fixed release as noted in WNPA-SEC-2026-80
Restrict opening of untrusted capture files on analyst workstations
Use dedicated, isolated virtual machines to review third-party Bluetooth capture data

Patch Information

Wireshark has published fixed builds addressing CVE-2026-76922 in the 4.6.x and 4.4.x branches. Consult the Wireshark Security Advisory WNPA-SEC-2026-80 and the GitLab Work Item #21452 for exact patched versions and commit references. Deploy the vendor-supplied installers or rebuild from patched source.

Workarounds

Disable the Bluetooth BR/EDR FHS dissector under Analyze → Enabled Protocols until the patched build is deployed
Avoid live capture on interfaces that receive Bluetooth BR/EDR traffic from untrusted sources
Perform capture file analysis with tshark in a non-interactive, ephemeral container so crashes do not disrupt analyst sessions

bash

# Disable the FHS dissector at the command line as a temporary workaround
tshark --disable-protocol bthci_evt \
       --disable-protocol btbrlmp \
       -r suspicious_capture.pcapng

# Verify installed Wireshark version against fixed release notes
wireshark --version