CVE-2026-76924 Overview
CVE-2026-76924 is an out-of-bounds read vulnerability [CWE-125] in the Wireshark Kerberos protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. An attacker can trigger a dissector crash by convincing a user to open a malicious capture file or by injecting a crafted packet into a live capture. Successful exploitation results in denial of service to the Wireshark process.
Critical Impact
Local users processing a malformed Kerberos packet in Wireshark can experience a dissector crash, disrupting network analysis workflows and forensic investigations.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- Kerberos protocol dissector component
Discovery Timeline
- 2026-08-19 - CVE-2026-76924 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76924
Vulnerability Analysis
The vulnerability resides in the Kerberos protocol dissector shipped with Wireshark. When the dissector parses a malformed Kerberos message, it performs a read outside the bounds of an allocated buffer. The out-of-bounds access causes the dissector to crash, terminating the Wireshark session and any ongoing capture analysis.
Exploitation requires local user interaction. An analyst must open a crafted capture file or process a malicious packet stream through a vulnerable Wireshark build. No elevated privileges are needed to trigger the condition. The impact is limited to availability of the analysis tool; the flaw does not expose memory contents to the attacker in a controlled fashion.
Root Cause
The root cause is improper bounds checking within the Kerberos dissector when parsing attacker-controlled field lengths or offsets. The dissector reads beyond the packet buffer, producing an invalid memory access that the process cannot recover from. Refer to the Wireshark Security Advisory and the associated GitLab Wireshark Work Item for the specific code paths and fix commits.
Attack Vector
Attack delivery is local and requires user interaction. Common delivery paths include sending a malicious .pcap or .pcapng file to an analyst, hosting a poisoned capture on a shared incident response repository, or injecting crafted Kerberos frames into a network segment being captured live. Opening the file or capturing the packet triggers the dissector fault.
Detection Methods for CVE-2026-76924
Indicators of Compromise
- Unexpected Wireshark or tshark process crashes when analyzing Kerberos traffic
- Capture files containing malformed Kerberos messages received from untrusted sources
- Repeated Wireshark termination events on analyst workstations processing shared .pcap files
Detection Strategies
- Inventory installed Wireshark builds across analyst and incident response workstations and flag versions in the affected ranges
- Monitor endpoint telemetry for repeated wireshark.exe or tshark abnormal exits correlated with .pcap or .pcapng file opens
- Inspect email and file-sharing gateways for capture files delivered from external senders and quarantine for review
Monitoring Recommendations
- Alert on Wireshark process crash events on hosts used for network forensics
- Track software inventory changes to confirm patched Wireshark versions are deployed
- Log user activity around capture file access on shared analyst file shares
How to Mitigate CVE-2026-76924
Immediate Actions Required
- Upgrade Wireshark to a fixed release outside the affected 4.6.0–4.6.7 and 4.4.0–4.4.18 ranges
- Avoid opening capture files received from untrusted or unverified sources until patched
- Restrict live capture on untrusted network segments from vulnerable Wireshark builds
Patch Information
Wireshark has published fix details in Wireshark Security Advisory wnpa-sec-2026-78. Administrators should apply the updated release identified in the advisory and validate the deployed version on all analyst systems. The corresponding upstream fix is tracked in the GitLab Wireshark Work Item.
Workarounds
- Disable the Kerberos dissector in Wireshark preferences under Analyze > Enabled Protocols until patching is complete
- Use tshark with dissector-disable flags when triaging untrusted captures, for example filtering out Kerberos traffic before opening in the GUI
- Analyze suspicious captures inside an isolated virtual machine to contain any dissector fault
# Disable the Kerberos dissector from the command line
tshark -r suspicious.pcap --disable-protocol kerberos
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
