CVE-2026-76923 Overview
CVE-2026-76923 is a denial-of-service vulnerability in the Wireshark Bluetooth Hands-Free Profile (HFP) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. An attacker can crash the dissector by supplying a crafted packet capture or by injecting malformed HFP traffic that Wireshark processes on the local system. The underlying weakness is an out-of-bounds read [CWE-125] in the HFP dissector logic. Exploitation requires user interaction, such as opening a malicious capture file, and results in process termination rather than code execution or data disclosure.
Critical Impact
A crafted Bluetooth HFP packet or capture file causes the Wireshark dissector to crash, producing a denial-of-service condition on the analyst workstation.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Bluetooth HFP protocol dissector component
Discovery Timeline
- 2026-08-19 - CVE-2026-76923 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76923
Vulnerability Analysis
The vulnerability resides in the Wireshark Bluetooth Hands-Free Profile (HFP) protocol dissector. When the dissector parses a malformed HFP packet, it reads memory outside the intended buffer boundaries. This out-of-bounds read [CWE-125] causes the Wireshark process to terminate abnormally.
The impact is limited to availability. The dissector crash halts packet analysis on the local workstation but does not expose memory contents to a remote attacker or permit code execution. Analysts running Wireshark against untrusted capture files or live captures containing attacker-influenced Bluetooth traffic are the primary risk population.
Wireshark is widely deployed on analyst workstations, incident response toolkits, and forensic imaging systems. Repeated crashes can disrupt investigations and delay analysis workflows. Refer to the Wireshark Security Advisory WNPA-SEC-2026-79 for the official vendor disclosure.
Root Cause
The HFP dissector performs insufficient bounds validation when parsing fields within HFP protocol data units. A malformed length field or truncated payload causes the parser to read beyond the allocated tvbuff, triggering an access violation. Full technical detail is available in GitLab Work Item #21451.
Attack Vector
Exploitation requires local access and user interaction. An attacker delivers a crafted .pcap or .pcapng capture file containing malformed Bluetooth HFP frames. When an analyst opens the file in Wireshark or tshark, the dissector processes the malicious frame and crashes. Live-capture exploitation is possible where an attacker can inject Bluetooth traffic within range of a monitored interface.
No verified public proof-of-concept code is available for CVE-2026-76923. The vulnerability mechanism is described in prose based on the vendor advisory.
Detection Methods for CVE-2026-76923
Indicators of Compromise
- Unexpected termination or crash reports from wireshark.exe, tshark, or dumpcap processes during Bluetooth capture analysis.
- Presence of unsolicited .pcap or .pcapng files containing Bluetooth HFP traffic delivered via email, chat, or shared storage.
- Repeated dissector assertion failures logged when opening specific capture files.
Detection Strategies
- Inventory installed Wireshark versions across analyst workstations and flag hosts running 4.6.0 to 4.6.7 or 4.4.0 to 4.4.18.
- Monitor for process crashes of Wireshark binaries via endpoint telemetry and correlate with recent file-open events for capture files.
- Scan file shares and mail gateways for .pcap and .pcapng attachments from untrusted senders.
Monitoring Recommendations
- Enable application crash reporting on analyst endpoints and forward Windows Error Reporting or Linux core-dump events to a central log store.
- Track Wireshark installations through software asset management to accelerate patch verification.
- Alert on capture files sourced from external or unmanaged locations that are opened by analyst accounts.
How to Mitigate CVE-2026-76923
Immediate Actions Required
- Upgrade Wireshark to a fixed release above 4.6.7 in the 4.6.x branch or above 4.4.18 in the 4.4.x branch as specified in WNPA-SEC-2026-79.
- Restrict analyst handling of untrusted capture files until patching is complete.
- Communicate the risk to incident response and forensics teams that routinely process third-party captures.
Patch Information
The Wireshark Foundation has published a fix through the Wireshark Security Advisory WNPA-SEC-2026-79. Apply the upgrade using the official installers or distribution package managers. The corresponding source change is tracked in GitLab Work Item #21451.
Workarounds
- Disable the Bluetooth HFP dissector under Analyze > Enabled Protocols in Wireshark until the upgrade is applied.
- Open suspicious capture files inside an isolated virtual machine to contain any crash impact.
- Use tshark with dissector filters that exclude Bluetooth HFP when triaging untrusted captures.
# Disable the HFP dissector at the command line
tshark -o "disabled_protos:bthfp" -r suspicious_capture.pcapng
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
