CVE-2026-76891

Wireshark's sharkd (the headless daemon used for server-side capture and dissection) contains an expired pointer dereference (CWE-825, a use-after-free-style memory bug) that can crash the process when it parses crafted input. Per the CVSS vector, the attack vector is network with low complexity and no privileges, but user interaction is required, meaning an attacker must get a sharkd instance or a user to process maliciously crafted capture/packet data. The impact is denial of service only: availability impact is high for the sharkd process, with no confidentiality or integrity impact, and no code execution is indicated. Anyone running Wireshark sharkd versions 4.6.0 through 4.6.7 or 4.4.0 through 4.4.18 is affected; the widely used Wireshark GUI itself is not cited in the advisory. There is no known in-the-wild exploitation: EPSS is 0.2% (8th percentile), it is not in CISA KEV, and only one public PoC/issue reference (a Wireshark GitLab tracker item) exists.

What to do: Upgrade Wireshark to a maintenance release newer than 4.6.7 on the 4.6 branch, or newer than 4.4.18 on the 4.4 branch. If upgrading is not immediately possible, avoid exposing sharkd (e.g., its JSON-RPC interface) to untrusted networks and do not use affected sharkd builds to parse captures from untrusted sources; monitor sharkd instances for crashes. Treat as low urgency given the 0.2% EPSS, absence from CISA KEV, and DoS-only impact.