CVE-2026-76881 - Vulnerability Details - OpenCVE

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Wireshark Foundation	Wireshark

No data.

No data.

References

Link	Providers
https://gitlab.com/wireshark/wireshark/-/work_items/21446
https://nvd.nist.gov/vuln/detail/CVE-2026-76881
https://www.cve.org/CVERecord?id=CVE-2026-76881
https://www.wireshark.org/security/wnpa-sec-2026-76.html

History

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-76881 https://www.cve.org/CVERecord?id=CVE-2026-76881
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 20 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Aug 2026 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wireshark Foundation Wireshark Foundation wireshark
Vendors & Products		Wireshark Foundation Wireshark Foundation wireshark

Wed, 19 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
Title		NULL Pointer Dereference in Wireshark
Weaknesses		CWE-476
References		https://gitlab.com/wireshark/wireshark/-/work_items/21446 https://www.wireshark.org/security/wnpa-sec-2026-76.html
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2026-08-19T22:34:59.927Z

Updated: 2026-08-20T15:00:57.084Z

Reserved: 2026-08-19T22:34:09.937Z

Link: CVE-2026-76881

Vulnrichment

Updated: 2026-08-20T15:00:49.833Z

NVD

Status : Received

Published: 2026-08-19T23:16:18.947

Modified: 2026-08-20T15:18:38.870

Link: CVE-2026-76881

Redhat

Severity : Moderate

Publid Date: 2026-08-19T22:34:59Z

Links: CVE-2026-76881 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76881", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-08-19T22:34:09.937Z", "datePublished": "2026-08-19T22:34:59.927Z", "dateUpdated": "2026-08-20T15:00:57.084Z"}, "containers": {"cna": {"title": "NULL Pointer Dereference in Wireshark", "descriptions": [{"lang": "en", "value": "CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.8", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.18", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-476: NULL Pointer Dereference", "cweId": "CWE-476", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-76.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21446"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.8 or above"}], "credits": [{"lang": "en", "value": "Aisle Research (Dmitrijs Trizna, Luigino Camastra, Ze Sheng (O2Lab & TAMU), Igor Morgenstern)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-08-19T22:34:59.927Z"}}, "adp": [{"references": [{"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21446", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T15:00:37.720955Z", "id": "CVE-2026-76881", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:00:57.084Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76881", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-08-19T22:34:09.937Z", "datePublished": "2026-08-19T22:34:59.927Z", "dateUpdated": "2026-08-20T15:00:57.084Z"}, "containers": {"cna": {"title": "NULL Pointer Dereference in Wireshark", "descriptions": [{"lang": "en", "value": "CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.8", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.18", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-476: NULL Pointer Dereference", "cweId": "CWE-476", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-76.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21446"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.8 or above"}], "credits": [{"lang": "en", "value": "Aisle Research (Dmitrijs Trizna, Luigino Camastra, Ze Sheng (O2Lab & TAMU), Igor Morgenstern)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-08-19T22:34:59.927Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76881", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:00:37.720955Z"}}}], "references": [{"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21446", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:00:49.833Z"}}]}}

{"bugzilla": {"description": "wireshark: Wireshark: Denial of service via CMS protocol dissector crash", "id": "2520078", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520078"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in Wireshark. A NULL pointer dereference vulnerability exists within the CMS (Cryptographic Message Syntax) protocol dissector. This issue can be triggered by processing a specially crafted network capture file, leading to an application crash. A remote attacker could exploit this to cause a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Do not open untrusted packet capture files or capture traffic from untrusted networks with Wireshark."}, "name": "CVE-2026-76881", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-19T22:34:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76881\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76881\nhttps://gitlab.com/wireshark/wireshark/-/work_items/21446\nhttps://www.wireshark.org/security/wnpa-sec-2026-76.html"], "statement": "A NULL pointer dereference was found in the CMS protocol dissector in Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.7. Red Hat Enterprise Linux 6, 7, 8, and 9 ship Wireshark versions prior to the affected range and are not vulnerable. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS ship an affected version of Wireshark.", "threat_severity": "Moderate"}