CVE-2026-76927 Overview
CVE-2026-76927 is a null pointer dereference vulnerability [CWE-476] in the Wireshark H.245 protocol dissector. The flaw causes the dissector to crash when processing malformed input, resulting in a denial of service condition. Affected versions include Wireshark 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18.
Exploitation requires local access and user interaction, typically opening a crafted capture file or feeding malformed traffic to a live capture session. The impact is limited to availability of the Wireshark process. No confidentiality or integrity impact exists.
Critical Impact
An attacker can crash Wireshark by supplying a malicious H.245 packet capture, disrupting network analysis workflows and forensic investigations.
Affected Products
- Wireshark 4.6.0 through 4.6.7
- Wireshark 4.4.0 through 4.4.18
- H.245 protocol dissector component
Discovery Timeline
- 2026-08-19 - CVE-2026-76927 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76927
Vulnerability Analysis
The vulnerability resides in the H.245 protocol dissector shipped with Wireshark. H.245 is a control channel protocol used in H.323 multimedia conferencing to negotiate call parameters, capabilities, and logical channels. The dissector parses H.245 messages inside packet captures for display and analysis.
When the dissector encounters a specifically malformed H.245 message, it dereferences a null pointer and crashes the Wireshark process or the tshark command-line utility. The crash terminates any active analysis session and discards unsaved state. See the Wireshark Security Advisory WNPA-SEC-2026-77 for the vendor description.
Root Cause
The root cause is a missing null check inside the H.245 dissector code path. The dissector assumes a protocol field or sub-structure is present after parsing, but a malformed message can leave the corresponding pointer unset. Subsequent access triggers the null pointer dereference [CWE-476].
Attack Vector
An attacker delivers a crafted packet capture file to a Wireshark user or injects malformed H.245 traffic onto a network segment where Wireshark is capturing live. When the analyst opens the file or the live dissector processes the frame, Wireshark crashes. The attack vector is local and requires user interaction, as reflected in the CVSS vector. Refer to the GitLab Wireshark Work Item for technical tracking details.
Detection Methods for CVE-2026-76927
Indicators of Compromise
- Unexpected Wireshark or tshark process crashes shortly after opening a .pcap or .pcapng file containing H.323 or H.245 traffic
- Crash dumps referencing the H.245 dissector module in Wireshark's stack trace
- Receipt of unsolicited capture files from untrusted sources referencing VoIP or conferencing traffic
Detection Strategies
- Inventory endpoints and analyst workstations running Wireshark 4.6.0-4.6.7 or 4.4.0-4.4.18 using software asset management tooling
- Monitor for repeated Wireshark process termination events in host telemetry, correlated with recent file-open activity
- Flag packet captures containing anomalous H.245 messages during pre-analysis triage in sandboxed environments
Monitoring Recommendations
- Log Wireshark launches and abnormal exits on analyst workstations and forward events to a central data lake for correlation
- Track file provenance for .pcap and .pcapng files opened by analysts, particularly those originating from external email or shared drives
- Alert on process crash signatures matching the Wireshark binary across the fleet
How to Mitigate CVE-2026-76927
Immediate Actions Required
- Upgrade Wireshark to a fixed release above 4.6.7 in the 4.6.x branch or above 4.4.18 in the 4.4.x branch as published in WNPA-SEC-2026-77
- Restrict opening packet captures from untrusted sources until patches are applied
- Analyze suspect captures inside isolated virtual machines with no sensitive data
Patch Information
The Wireshark Foundation released fixed builds addressing the H.245 dissector crash. Consult the Wireshark Security Advisory WNPA-SEC-2026-77 for the exact fixed version numbers and the corresponding GitLab Wireshark Work Item for the patch commit details.
Workarounds
- Disable the H.245 dissector through Analyze → Enabled Protocols in the Wireshark UI when handling untrusted captures
- Use tshark with --disable-protocol h245 for command-line analysis where the H.245 dissector is not required
- Pre-filter captures with a trusted tool to strip H.245 traffic before opening in vulnerable Wireshark builds
# Disable the H.245 dissector when running tshark on untrusted captures
tshark -r suspect.pcapng --disable-protocol h245
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
