CVE-2026-76888 is a low severity (3.1) flaw in Wireshark's RDP protocol dissector. A malformed packet or capture file could crash Wireshark. The project fixed it in 4.6.8 and 4.4.18 and says it knows of no exploits. A linked issue report describes a heap overflow, so patch rather than wait.
What's affected
Wireshark's advisory wnpa-sec-2026-67, dated 12 August 2026, lists affected versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.17, and fixed versions 4.6.8 and 4.4.18. Impact is stated as a crash, and the project says it is unaware of any exploits.
Where sources differ. The record says 4.4.0 to 4.4.18, while the advisory says 4.4.0 to 4.4.17 with 4.4.18 as the fix. Use 4.4.18 as the safe version. On severity, the record rates it 3.1 Low and the advisory only says the dissector could crash. The linked public issue is titled as an off-by-one heap overflow in the RDP8 ZGFX decompressor and its reporter argues for memory corruption beyond a crash. The record's CWE-122 matches a heap overflow, so the 3.1 score may understate the technical weakness. We say both and recommend patching.
How to check if you're exposed
Print the version of every Wireshark and TShark install, including copies on analyst laptops, jump hosts and build images:
wireshark -v
tshark -v
Affected: 4.6.0 to 4.6.7 and 4.4.0 to 4.4.17. Anything older than 4.4 is outside what the advisory lists, so check the project page for end of support. Also find automated jobs that run TShark on captures from outside, such as sandbox pipelines or packet inspection scripts, because those open untrusted files without a person in the loop.
What to do now
- Upgrade Wireshark to 4.6.8 or 4.4.18 or later, the versions the advisory names.
- Upgrade TShark and any bundled copies, such as those in tooling images.
- Until then, avoid opening capture files from untrusted sources and avoid live capture on untrusted networks with the vulnerable build.
- Review automation that runs TShark on files you did not create, and add the update there first.
- Record the version after the upgrade.
Why it matters
The Wireshark advisory says only that the RDP dissector could crash, and that a person might trigger it by injecting a malformed packet onto the wire or by convincing someone to read a malformed capture file. The public issue gives more detail: a size check in the decompressor uses an equality test where a greater-than-or-equal test is needed, so output can run one byte past a buffer. The record files the weakness under CWE-122, a heap-based buffer overflow.
Packet analyzers parse data that attackers shape, which is why dissector bugs show up so often. The score is low because the record's vector needs user interaction and high attack complexity, and rates the impact as availability only. The practical rule is simple: keep the tool current and treat unknown capture files like unknown attachments.
Quick check
Is this exploited?
Wireshark says it is unaware of any exploits. The record does not mark it as a CISA KEV entry.
How would someone trigger it?
By getting a malformed packet onto the wire or convincing someone to open a malformed capture file, according to the advisory.
Sources
Last reviewed: 18 October 2026.
