CVE-2026-76890

A use-after-free flaw (CWE-825, expired pointer dereference) in Wireshark's sharkd daemon can crash the process when it processes crafted capture data. sharkd is typically triggered to analyze attacker-influenced packet or capture-file input, which the CVSS vector reflects as network access combined with user interaction (AV:N/UI:R). A successful trigger only yields denial of service: the daemon dereferences a freed pointer and crashes, with no confidentiality or integrity impact (6.5 medium, availability only). Affected users are anyone running Wireshark 4.6.0 through 4.6.7 or 4.4.0 through 4.4.18, with the greatest practical risk in deployments where sharkd runs as a shared or network-facing analysis service handling untrusted files. There is no known in-the-wild exploitation; one public proof-of-concept reference exists in the upstream Wireshark tracker (GitLab work item 21399), and EPSS estimates only about 0.2 percent exploitation probability over 30 days, with the CVE not in CISA KEV.

What to do: Upgrade Wireshark to a patch release newer than 4.6.7 on the 4.6 branch or 4.4.18 on the 4.4 branch. Until patched, avoid having sharkd analyze untrusted capture files, restrict sharkd access to trusted users and networks, and monitor the daemon for crash/restart events. Track the upstream issue (GitLab work item 21399) for fix status.