CVE-2026-76927

Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 contain a null pointer dereference (CWE-476) in the H.245 protocol dissector, the component that decodes H.323 multimedia call-signaling traffic. The crash is triggered when the dissector processes crafted or malformed H.245 data, such as specially crafted packets sent across a network being monitored during a live capture or a malicious capture file being parsed. The impact is denial of service only: the Wireshark or tshark process crashes, with no confidentiality or integrity impact and no indication of code execution. Anyone running the affected releases is affected, with practical risk concentrated on analysts and monitoring hosts dissecting traffic containing H.245 (VoIP/video conferencing) flows. There is no confirmed in-the-wild exploitation: EPSS estimates roughly a 0.2% probability of exploitation within 30 days (5th percentile), the flaw is not in CISA KEV, and only one public PoC/issue reference (Wireshark GitLab work item) is available.

What to do: Upgrade Wireshark on affected hosts to a release newer than 4.6.7 on the 4.6 branch or newer than 4.4.18 on the 4.4 branch as soon as patched packages are available. As an interim mitigation, disable the H.245 dissector (Analyze > Enabled Protocols, or the equivalent tshark/disable-protocol setting) and avoid opening capture files from untrusted sources with affected versions. Track the referenced GitLab work item for the fixed releases and any additional details.