Loading story…
Wireshark disclosed and fixed a vulnerability in its UMTS RRC protocol dissector that could corrupt heap memory and crash the application during packet dissection. The flaw, assigned CVE-2026-76880, stemmed from a protocol-valid, packet-controlled RB-Identity value being stored in private state and later used directly as an array index, allowing writes beyond the intended bounds of rrc_ciphering_info.seq_no and corruption of adjacent heap-allocated ciphering state.
According to Wireshark's security advisory wnpa-sec-2026-88, the issue affects versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, and was fixed in 4.6.8 and 4.4.18. An attacker could trigger the bug by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file; Wireshark said no active exploits were known at the time of disclosure, and the underlying fix was tracked in the project's GitLab issue and resolved with commit a44c8dc0.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-12, Wireshark published security notice wnpa-sec-2026-88 describing an RRC protocol dissector crash issue that could be triggered by malformed network packets or crafted capture files. The notice said no exploits were known at publication time and recommended upgrading to fixed releases.
Wireshark fixed the RRC dissector vulnerability in versions 4.6.8 and 4.4.18. Affected versions were 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17.
Wireshark tracked the vulnerability in GitLab issue 21478, titled "Fix potential heap corruption in UMTS RRC," and closed it with commit a44c8dc0 after related merge requests were merged. The issue was assigned CVE-2026-76880.
Aisle Research discovered a heap corruption vulnerability in Wireshark's UMTS RRC dissector, with credit given to Dmitrijs Trizna, Luigino Camastra, Ze Sheng of O2Lab and TAMU, and Igor Morgenstern. The flaw involved packet-controlled RB-Identity values being used as an array index, risking corruption of adjacent heap state during dissection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed and fixed memory-safety flaws in its UMTS FP dissector that could be triggered by malformed network traffic or crafted packet capture files opened in **Wireshark**, `tshark`, or `sharkd`. One issue, tracked as **CVE-2026-15169** and published as **wnpa-sec-2026-59**, stems from `dissect_e_dch_t2_or_common_channel_info()` writing past a static `subframes[16]` array in the UMTS FP E-DCH Type-2 parser, enabling memory corruption and at minimum a reliable denial of service. Wireshark said the bug affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and was fixed in **4.6.7** and **4.4.17**. A related flaw in the same function was later assigned **CVE-2026-76889** after researchers showed that a packet-controlled continuation flag could keep MAC-is descriptor parsing running beyond 16 entries, causing fixed-array out-of-bounds writes to `mac_is_lchid[pdu_no][16]` and `mac_is_length[pdu_no][16]`. The bugs were reproduced with sanitizers against development and pre-release builds, and Wireshark closed the reports after merging fixes including **!25692** for UMTS-FP limits checking and **!25780** for the MAC-is descriptor handling issue. The disclosures indicate the vulnerabilities could be exploited through injected malformed packets or malicious trace files, although no public exploits were reported at disclosure time.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026