CVE-2026-76920

Wireshark contains an out-of-bounds write (CWE-787) in its 3GPP phone log file parser that crashes the application when parsing a malformed file. The flaw is triggered locally (AV:L) and requires user interaction (UI:R): a user must open a crafted 3GPP phone log file in an affected Wireshark version. The impact is denial of service - the CVSS vector shows high availability impact with no confidentiality or integrity impact. Users running Wireshark 4.6.0 through 4.6.7 or 4.4.0 through 4.4.18 are affected. Exploitation is not currently known in the wild (not in CISA KEV, EPSS ~0.1%), but a public PoC/reference exists in the Wireshark GitLab tracker (work item 21454).

What to do: Upgrade Wireshark to a release newer than the affected ranges - later than 4.6.7 on the 4.6 branch or later than 4.4.18 on the 4.4 branch - per the project's advisory (GitLab work item 21454). Until patched, avoid opening 3GPP phone log files from untrusted sources in Wireshark, and check whether analysts or tooling in your environment process such files.