CVE-2026-76881

CVE-2026-76881 is a NULL pointer dereference (CWE-476) in the CMS (Cryptographic Message Syntax) protocol dissector of Wireshark, which crashes the application when it dissects malformed or specially crafted CMS data. Triggering it requires local user interaction, typically opening a malicious capture file or having crafted packets dissected, consistent with the CVSS local-attack/user-interaction vector. An attacker gains only denial of service: the Wireshark GUI or a TShark process terminates, with no confidentiality or integrity impact and no code execution. Anyone running Wireshark 4.6.0 through 4.6.7 or 4.4.0 through 4.4.18 is affected, including automated environments where TShark parses untrusted capture files. No in-the-wild exploitation is known (EPSS about 0.1%, not in CISA KEV), but a public issue with reproducer details is tracked on the Wireshark GitLab (work item 21446).

What to do: Update Wireshark to a release newer than 4.6.7 on the 4.6 branch or newer than 4.4.18 on the 4.4 branch as soon as the fix is available. As an interim mitigation, disable the CMS dissector via Analyze > Enabled Protocols (uncheck 'cms') or avoid opening untrusted capture files with affected versions. Prioritize patching hosts where TShark or Wireshark automatically processes third-party pcaps, since a crafted file will crash those sessions.