CVE-2026-76921

A flaw was found in Wireshark. A use-after-free vulnerability exists in the CMS (Cryptographic Message Syntax) protocol dissector. An attacker could exploit this by crafting a malicious network packet, leading to a crash and a denial of service (DoS) for the application.

This vulnerability is rated Moderate because exploitation requires user interaction (opening a crafted capture file or inspecting malicious traffic) and results only in an application crash. Since Wireshark is an interactive diagnostic tool rather than a continuous privileged daemon, the impact is strictly confined to a local denial of service for the active session, with no risk of privilege escalation or system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this do not open untrusted packet captures in Wireshark/tshark, and avoid exposing dissectors to untrusted LDAP/CMS traffic on the wire. Prefer analyzing captures in an isolated session or sandbox rather than on production hosts