CVE-2026-76922

Wireshark releases 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 contain a flaw (CWE-476, null pointer dereference) in the Bluetooth BR/EDR FHS protocol dissector that causes the application to crash. The crash is triggered when Wireshark or TShark dissects a crafted Bluetooth FHS packet, for example when a user opens a malicious capture file or analyzes live Bluetooth BR/EDR traffic. An attacker gains denial of service only: the capture session or analysis run aborts, with no confidentiality or integrity impact and no indication of code execution (CVSS C:N/I:N/A:H, local vector requiring user interaction). Anyone running the affected releases who dissects Bluetooth BR/EDR captures is affected. There is no evidence of in-the-wild exploitation: EPSS is 0.1% (1st percentile), the flaw is not in CISA KEV, and the only public reference is a Wireshark issue-tracker work item.

What to do: Upgrade to a Wireshark release newer than 4.6.7 on the 4.6 branch or newer than 4.4.18 on the 4.4 branch (the latest maintenance release of each branch). Until then, avoid opening untrusted capture files containing Bluetooth BR/EDR traffic, and consider disabling the FHS dissector via Wireshark's Enabled Protocols dialog when analyzing Bluetooth captures. No in-the-wild exploitation is reported, so routine patching cadence is reasonable.