CVE-2026-76929

CVE-2026-76929 is an out-of-bounds read (CWE-125) in the pcapng capture-file parser of Wireshark, affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. It is triggered when the application parses a malformed, attacker-crafted pcapng file, causing the parser to read beyond the intended buffer and crash the process. The impact is denial of service only: the capture session or application terminates, with no code execution and no confidentiality or integrity impact (CVSS 5.5, local vector requiring user interaction). Anyone running the affected 4.4.x or 4.6.x releases who opens capture files from untrusted sources is affected; remote attackers cannot exploit it directly without getting a user to process the file. There is no evidence of in-the-wild exploitation so far: the flaw is not in CISA KEV, EPSS is 0.1%, and the only public reference is a Wireshark bug-tracker issue (work item 21460).

What to do: Upgrade Wireshark to a release later than 4.6.7 in the 4.6 branch or later than 4.4.18 in the 4.4 branch (the next maintenance release in each branch). Until patched, avoid opening pcapng capture files from untrusted sources with affected versions, and verify the installed Wireshark version before processing third-party capture files.