Loading story…
Wireshark disclosed CVE-2026-7376, a denial-of-service flaw in the sharkd utility caused by a NULL pointer dereference when the comment parameter is omitted from setcomment. The issue was tracked as Wireshark issue #21206 and reported by Alexandre de Oliveira, with the bug leading to a crash rather than code execution.
The vulnerability affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Wireshark said the flaw was fixed in 4.6.5 and 4.4.15, and noted that no exploits are known at the time of disclosure.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory WNPA-SEC-2026-48 for CVE-2026-7376, a sharkd utility crash issue affecting versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The company said the flaw was fixed in versions 4.6.5 and 4.4.15, credited Alexandre de Oliveira with discovery, and stated it knew of no exploits.
A GitLab issue was opened for a NULL pointer dereference in sharkd's setcomment handling when the comment parameter is omitted. This issue is tracked as Wireshark issue 21206.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed a vulnerability in its `sharkd` backend, tracked as **CVE-2026-76890**, after researchers found a use-after-return bug in `sharkd_session_process_iograph()`. The flaw stems from tap listeners being registered from a stack-allocated graphs array and not being removed on an error path, leaving global callbacks pointing to freed memory. A later attacker-controlled retap can invoke `sharkd_iograph_packet()` on the stale pointer, causing memory corruption and a reliable crash; the issue affects `sharkd` specifically rather than `tshark`. The vendor said malformed packets delivered on the network or through a crafted capture file could trigger the crash in affected releases. Wireshark reported that versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17** are vulnerable, and fixed the issue in **4.6.8** and **4.4.18**; the original bug report said the flaw traces back to releases starting with **3.6.0**. The vulnerability was reported by David Korczynski of Ada Logics and credited to findings by Claude and Ada Logics, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed **CVE-2026-7378**, a flaw in the `sharkd` utility that can cause the daemon to crash when filter state from a previously loaded capture file is reused in the same session. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and has been fixed in **4.6.5** and **4.4.15**. Wireshark said it is not aware of active exploitation and credited the discovery to **Alexandre de Oliveira**. The underlying bug was traced to a **heap-buffer-overflow** in `sharkd`'s `frames` method, where cached filter bitmaps were kept in a session-wide hash table and not invalidated when a new capture file was loaded. That allowed a bitmap sized for one capture to be reused against a later capture with a different frame count, leading to an out-of-bounds read in `sharkd_session_process_frames`. Maintainers said triggering the flaw requires loading two captures in one session, reusing the same filter string, and making the second capture larger under specific matching conditions; the fix clears the filter table whenever a new file is loaded.
Aug 21, 2026
Wireshark disclosed **CVE-2026-15171**, a denial-of-service flaw in the SSH protocol dissector that can crash the application when a user opens a specially crafted `pcapng` trace file. The bug stems from a NULL pointer dereference in `ssh_keylog_process_line()` while parsing a malformed **SSH Decryption Secrets Block**, where empty or oversized hex tokens can cause `ssh_kex_make_bignum()` to return `NULL` and then be dereferenced. The issue affects workflows that process untrusted capture files with embedded SSH decryption metadata, including the Wireshark GUI, `tshark`, and `sharkd`, but it is **not** triggered by malicious SSH network traffic alone because the attacker-controlled input must be in `pcapng` metadata. Wireshark said the flaw affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, with fixes released in **4.6.7** and **4.4.17**; the bug was reproduced with AddressSanitizer via OSS-Fuzz, and no active exploits were known at disclosure time.
Aug 21, 2026