CVE-2026-76924

A crash in Wireshark's Kerberos dissector sounds like an inconvenience, but for the security teams who rely on this tool for incident response, it's worse than it appears. The malformed packet that crashes your capture doesn't just deny you a view into the network — it blinds you at the exact moment you're investigating an intrusion. The attacker who sent that packet bought themselves time while you switch tools and reorient. That's the real blast radius, and it's not captured by the CVSS 5.5 DoS rating. The vulnerability affects both the 4.4.x LTS and 4.6.x branches, which is analytically significant. This parallel existence suggests either the same flawed parsing pattern was backported, or the Kerberos dissector has structural traps that multiple contributors independently stumble into. Either scenario points to a maintenance model problem: dissectors are expected to consume hostile traffic gracefully, but they're often maintained by volunteers focused on parsing legitimate traffic correctly, not surviving adversarial input. The CVSS rating likely understates the risk. Dissector bugs that crash on malformed input typically stem from the same missing bounds checks and unhandled state machine edge cases that enable memory corruption under different conditions. Just because the reported PoC only crashes the tool doesn't mean controlled read/write isn't achievable with different framing. The DoS-only rating may reflect effort invested, not exploit difficulty. What you should do: First, patch immediately — the exposure window matters less than the operational blackout risk. Second, treat this as a signal to audit the Kerberos dissector for similar patterns. Kerberos has accumulated parsing logic across four decades of RFC evolution — edge cases from v4/v5 transitions, GSS-API encapsulation, and various extensions create what amounts to sediment layers of forgotten assumptions. One crash means someone already found a crack in that structure; static analysis of the same parsing state machine is the logical next step. If your team runs Wireshark as deployed infrastructure rather than a dev tool, prioritize this patch regardless of the MEDIUM rating — the collateral damage of an investigation blackout exceeds what the score captures.

Reviewed through automated stages and approved by a human before publication.