CVE-2026-76929: Pcapng File Parser DoS Vulnerability

CVE-2026-76929 Overview

CVE-2026-76929 is a denial-of-service vulnerability in the Wireshark pcapng file parser. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. A crafted pcapng capture file triggers an out-of-bounds read [CWE-125] in the parser, crashing the application. Exploitation requires a local user to open a malicious capture file, so the impact is limited to loss of availability for the Wireshark process. The issue is tracked in Wireshark Security Advisory WNPA-SEC-2026-84 and the corresponding GitLab Wireshark Work Item.

Critical Impact
A malformed pcapng file causes Wireshark to crash, disrupting packet analysis workflows for incident responders and network engineers.

Affected Products

Wireshark 4.6.0 through 4.6.7
Wireshark 4.4.0 through 4.4.18
Systems using the affected Wireshark pcapng file parser

Discovery Timeline

2026-08-19 - CVE-2026-76929 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76929

Vulnerability Analysis

The vulnerability resides in the Wireshark pcapng file parser. Pcapng is the next-generation packet capture file format used by Wireshark and related tools. When the parser processes a specifically crafted pcapng file, it reads memory outside the intended bounds of an allocated buffer. The out-of-bounds read causes the process to crash, terminating the analysis session and any unsaved work.

The flaw is categorized as [CWE-125] Out-of-bounds Read. Because the impacted operation is a read rather than a write, the vulnerability does not permit code execution or memory disclosure sufficient to compromise confidentiality or integrity. The exploitation outcome is limited to a process crash.

Root Cause

The root cause is inadequate bounds validation while parsing block or option structures within a pcapng file. The parser trusts length or offset fields embedded in the capture file and dereferences memory beyond the mapped buffer. Refer to the GitLab Wireshark Work Item for the specific parser location and fix commit.

Attack Vector

An attacker crafts a malicious pcapng file and delivers it to a target analyst through email, chat, a shared capture repository, or a threat intelligence feed. The analyst opens the file in Wireshark, and the parser crashes. Exploitation requires local file handling and user interaction, and there is no network-reachable attack surface. No public exploit code is reported for this issue.

Code examples are not published for this issue. See the vendor advisory for technical details.

Detection Methods for CVE-2026-76929

Indicators of Compromise

Unexpected Wireshark process crashes or crash-dump files generated after opening a capture file
Pcapng files received from untrusted sources with abnormally large block length or option length fields
Repeated crash telemetry from wireshark.exe, wireshark, or tshark binaries on analyst workstations

Detection Strategies

Inventory Wireshark installations and flag any host running versions in the 4.6.0–4.6.7 or 4.4.0–4.4.18 ranges
Correlate application crash events with recent file-open activity on .pcapng files sourced from external senders
Scan email gateways and file-sharing platforms for pcapng attachments delivered to security operations staff

Monitoring Recommendations

Forward Windows Application event log crash entries and Linux core-dump events to your SIEM for triage
Alert on Wireshark process termination immediately following a pcapng file being written to a user download directory
Track file provenance for capture files entering the analyst environment through automated pipelines

How to Mitigate CVE-2026-76929

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the affected 4.6.0–4.6.7 and 4.4.0–4.4.18 ranges as identified in WNPA-SEC-2026-84
Restrict opening of pcapng files that originate from untrusted or unverified sources
Communicate the risk to incident response and network engineering teams that routinely process third-party captures

Patch Information

The Wireshark Foundation addressed the parser flaw in updates listed in Wireshark Security Advisory WNPA-SEC-2026-84. Details of the code change are tracked in the GitLab Wireshark Work Item. Apply the fixed release for the branch your organization uses.

Workarounds

Open suspicious pcapng files inside an isolated virtual machine or sandbox to contain crashes
Convert untrusted captures to another format using a hardened preprocessing utility before opening in Wireshark
Preserve unsaved analyst work by exporting intermediate results frequently until the patch is deployed

bash

# Verify the installed Wireshark version and upgrade if in the affected range
wireshark --version
tshark --version

# Example upgrade on Debian/Ubuntu once fixed packages are available
sudo apt update && sudo apt install --only-upgrade wireshark tshark