CVE-2026-76888

CVE-2026-76888 is a heap-based buffer overflow (CWE-122) in Wireshark's RDP protocol dissector that crashes the application while parsing crafted RDP traffic. It can be triggered over the network without authentication or user interaction (CVSS AV:N/UI:N) — for example when a live capture on a monitored network encounters attacker-controlled RDP packets, or when an analyst opens a malicious capture file. The impact is denial of service only: the crash takes down the Wireshark/tshark process with no confidentiality or integrity impact, though an unattended capture on a monitoring point stops collecting traffic until restarted. Anyone running Wireshark 4.6.0 through 4.6.7 or 4.4.0 through 4.4.18 and dissecting RDP traffic is affected. Exploitation has not been confirmed in the wild (EPSS ~0.2%, not in CISA KEV), but a public issue with a PoC exists on the Wireshark GitLab tracker (work item 21396).

What to do: Upgrade to a Wireshark release later than 4.6.7 in the 4.6 line or later than 4.4.18 in the 4.4 line, checking the Wireshark advisory (GitLab work item 21396) for the exact fixed versions. As an interim mitigation, disable the RDP dissector (Analyze > Enabled Protocols) when examining untrusted traffic or capture files, and be cautious opening pcaps from untrusted sources. Teams running unattended captures (e.g., tshark) on networks carrying RDP should prioritize patching, since a crash there silently stops traffic collection.