External risk intelligence

Wireshark C12.22 Protocol Dissector Denial of Service.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76886

Wireshark is a network protocol analyzer used locally by network administrators and security analysts to inspect traffic. It is a client-side desktop application, not a network-facing service, gateway, or internet-accessible appliance. Exposure to the internet is not a component of its normal operation or deployment pattern.

Denial of Service

Wireshark

4.4.0 to before 4.4.184.6.0 to before 4.6.8

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the C12.22 protocol dissector within Wireshark software. This issue could allow for a denial-of-service attack, potentially impacting network analysis capabilities.

Protocol dissector crash could halt analysis.
Affects network analysis tool users.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending specially crafted network traffic to a system running a vulnerable version of Wireshark. The flaw lies within the C12.22 protocol dissector, which, when processing malicious data, can lead to a crash. This crash could potentially be exploited to achieve denial of service, impacting the availability of the Wireshark application and the analysis it performs.

Network traffic can reach vulnerable Wireshark.
Malformed C12.22 data triggers the crash.
Denial of service impacts analysis.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to crash the Wireshark application when processing C12.22 protocol dissector data. This could impact the availability of the analysis tool for network administrators.

Network traffic data integrity.
Processing malicious network data.
Denial of service for analysis tool.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Wireshark protocol dissectors, a tool typically used by network administrators and security analysts for local traffic analysis. Real-world ownership will likely fall to the teams responsible for endpoint security tooling and network analysis. The first practical step is to identify all systems running the affected Wireshark versions, determine if they are business-critical, and confirm the accountable owner before planning remediation.

Identify impacted systems and owners.
Verify Wireshark deployment and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wireshark and how is it used?

Wireshark is a widely used open-source network protocol analyzer. Security professionals and network administrators run it locally on their systems to capture and inspect the fine-grained details of data packets flowing across a network. By acting as a microscope for network traffic, it helps users troubleshoot connectivity issues, analyze protocol behavior, and investigate potential security incidents in real time.

What does CVE-2026-76886 mean for Wireshark?

This CVE identifies a weakness known as a heap-based buffer overflow, categorized as CWE-122. In plain English, the software's component responsible for interpreting C12.22 protocol data fails to manage memory correctly when it encounters specific, malformed patterns. This flaw causes the application to crash, rendering it unable to continue analyzing traffic until the software is restarted.

How is this Wireshark vulnerability triggered?

An attacker must supply specially crafted network traffic that specifically targets the C12.22 protocol dissector within Wireshark. Simply running the software or processing standard, legitimate network traffic does not trigger the crash; the application only fails when it attempts to parse the specific, malformed data structures designed to exploit this memory handling error.

Why does Halo Surface Signal rate this as unlikely?

Halo Surface Signal flags this as 'Very unlikely' because Wireshark is primarily a desktop application for local analysis, not a service or gateway exposed to the internet. Since it is not designed to be an internet-facing appliance, the chance of an attacker successfully directing malicious packets into a user's active capture session during standard operational use is generally low.

When should I update my Wireshark installation?

You should prioritize updating if you actively use Wireshark in environments where you monitor untrusted or external network traffic. Begin by creating an inventory of your systems to identify those running the affected 4.4.x or 4.6.x versions. Once identified, plan to upgrade to a patched release to ensure the stability of your analysis capabilities against malformed C12.22 data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.