Loading story…
Wireshark disclosed and fixed multiple denial-of-service flaws in its Bluetooth BR/EDR packet dissection logic that could crash Wireshark or TShark when processing malformed traffic or crafted capture files. One issue, tracked as CVE-2026-76922, affected the BR/EDR RF dissector after fragmented L2CAP reassembly used an unregistered reassembly table, leading to a null-pointer dereference and segmentation fault; a specially crafted two-record capture could trigger the crash after valid BR/EDR connection setup. The bug was classified as CWE-476 with a CVSS 5.5 rating, and the fix registers the l2cap_msg_reassembly_table during protocol initialization so incomplete reassembly is handled safely instead of crashing.
Wireshark also published security advisory wnpa-sec-2026-80 for a separate crash in the Bluetooth BR/EDR FHS protocol dissector. That flaw affects versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, and was fixed in 4.6.8 and 4.4.18. According to the advisory, a malformed packet injected on the wire or embedded in a packet capture file could terminate the application, though no active exploitation was known at disclosure. The issues were reported with contributions from researchers at Aisle Research, O2Lab, and Texas A&M University.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Wireshark published security notice wnpa-sec-2026-80 for a crash vulnerability in the Bluetooth BR/EDR FHS protocol dissector, crediting Aisle Research, O2Lab, and Texas A&M University researchers. The advisory said affected versions were 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, fixed in 4.6.8 and 4.4.18, and that no exploits were known at disclosure time.
Wireshark merged a remediation that registers l2cap_msg_reassembly_table in proto_register_btbredr_rf() using addresses_reassembly_table_functions. After the patch, the proof-of-concept capture no longer triggered the zero-program-counter segmentation fault and was retained as incomplete L2CAP reassembly.
Aisle Security reported a medium-severity denial-of-service vulnerability in Wireshark's Bluetooth BR/EDR RF dissector, where an unregistered L2CAP reassembly table could let a crafted two-record capture crash Wireshark or TShark. The issue was tracked as Wireshark issue 21452 and later assigned CVE-2026-76922.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed a denial-of-service vulnerability in its BEEP protocol dissector that can crash the packet analyzer through a stack-call overflow caused by recursive function handling. The issue is tracked as **CVE-2026-6538** and documented in advisory **`wnpa-sec-2026-23`**, with the underlying bug reported in Wireshark's issue tracker as a BEEP dissector stack-call overflow. The flaw affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. According to the vendor, an attacker could trigger the crash by injecting a malformed packet onto the network or by convincing a user to open a crafted capture file. Wireshark said no active exploits are known, credited Sharon Brizinov with discovery, and released fixes in versions **4.6.5** and **4.4.15**.
Aug 21, 2026
Wireshark disclosed and fixed a vulnerability in its UMTS RRC protocol dissector that could corrupt heap memory and crash the application during packet dissection. The flaw, assigned **`CVE-2026-76880`**, stemmed from a protocol-valid, packet-controlled `RB-Identity` value being stored in private state and later used directly as an array index, allowing writes beyond the intended bounds of `rrc_ciphering_info.seq_no` and corruption of adjacent heap-allocated ciphering state. According to Wireshark's security advisory **`wnpa-sec-2026-88`**, the issue affects versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, and was fixed in **4.6.8** and **4.4.18**. An attacker could trigger the bug by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file; Wireshark said no active exploits were known at the time of disclosure, and the underlying fix was tracked in the project's GitLab issue and resolved with commit **`a44c8dc0`**.
Aug 21, 2026
Wireshark disclosed and fixed memory-safety flaws in its UMTS FP dissector that could be triggered by malformed network traffic or crafted packet capture files opened in **Wireshark**, `tshark`, or `sharkd`. One issue, tracked as **CVE-2026-15169** and published as **wnpa-sec-2026-59**, stems from `dissect_e_dch_t2_or_common_channel_info()` writing past a static `subframes[16]` array in the UMTS FP E-DCH Type-2 parser, enabling memory corruption and at minimum a reliable denial of service. Wireshark said the bug affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and was fixed in **4.6.7** and **4.4.17**. A related flaw in the same function was later assigned **CVE-2026-76889** after researchers showed that a packet-controlled continuation flag could keep MAC-is descriptor parsing running beyond 16 entries, causing fixed-array out-of-bounds writes to `mac_is_lchid[pdu_no][16]` and `mac_is_length[pdu_no][16]`. The bugs were reproduced with sanitizers against development and pre-release builds, and Wireshark closed the reports after merging fixes including **!25692** for UMTS-FP limits checking and **!25780** for the MAC-is descriptor handling issue. The disclosures indicate the vulnerabilities could be exploited through injected malformed packets or malicious trace files, although no public exploits were reported at disclosure time.
Aug 21, 2026