CVE-2026-76886 is a high severity (CVSS 8.1) crash in the Wireshark C12.22 protocol dissector. A malformed packet or capture file can make Wireshark or TShark crash. Wireshark fixed it in 4.6.8 and 4.4.18, so upgrade to one of those or later.
What's affected
- Product: Wireshark and TShark.
- Affected: 4.6.0 to 4.6.7 and 4.4.0 to 4.4.17, per the Wireshark advisory wnpa-sec-2026-75. The NVD text gives 4.4.0 to 4.4.18, so trust the Wireshark advisory.
- Fixed: 4.6.8 and 4.4.18.
- Weakness: CWE-122, heap-based buffer overflow.
- CVSS 8.1 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. - Wireshark says it is unaware of any exploits. Not listed in CISA KEV.
How to check if you're exposed
Check the installed version on every analyst workstation, server and build image that carries Wireshark or TShark.
tshark --version | head -1
wireshark --version | head -1
The public issue says the path needs the c1222.decrypt setting turned on and a matching entry in the decryption table, so that setting is worth checking too. It only matters if you analyze C12.22 smart meter traffic.
What to do now
- Upgrade Wireshark to 4.6.8 or 4.4.18, or later, using your package manager or the official installers.
- Update the copies inside container images, jump hosts and forensic tool kits.
- Do not open captures from untrusted sources on a workstation that matters. Use a disposable VM.
- Run capture tools with least privilege, and avoid running the GUI as root.
- Keep dissectors you do not use turned off where your workflow allows.
Why it matters
The public issue describes a length value that gets narrowed to 16 bits, so a sum wraps and a small buffer is allocated, followed by much larger copies. The crash is the confirmed outcome. The reporter says disclosure or code execution from the heap damage was not demonstrated.
Packet analyzers parse hostile input by design. Every dissector is a parser exposed to whatever is on the wire or in a file you were sent. Keep the tool current, and treat capture files as untrusted data.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to use C12.22 to be affected?
The public issue says the code path needs the c1222.decrypt setting turned on and a matching key entry. Upgrading is still the simple answer.
Can this run code?
The reporter confirmed a crash and says code execution was not demonstrated.
Sources
Last reviewed: 19 October 2026.
