CVE-2026-76917

This CVE targets a NULL pointer dereference in Wireshark's AVRCP dissector that triggers when processing malformed Bluetooth AVDTP signaling packets. Versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 are both affected — meaning the bug exists in both the main development line and the long-term support branch, a pattern that should concern anyone running Wireshark in production security research environments. The operational risk is straightforward but easy to understate: security researchers, malware reversers, and penetration testers routinely open pcap files from untrusted Bluetooth sources — honeypot captures, compromised devices, defect samples. A malformed packet that crashes the AVRCP dissector doesn't just crash Wireshark — it kills the entire capture session, rendering every subsequent packet in the file inaccessible. This is a control-plane dissector bug with data-plane blast radius. Check your environments: if you're running Wireshark 4.4.x in production analysis, confirm whether your distribution has backported the patch. The 4.4.x LTS branch being affected means the bug predates the 4.6.x cycle — it was either backported or independently existed in both branches. Either way, the LTS patch status is the immediate question. Update to 4.4.19 or later for the LTS branch, and 4.6.8 or later for mainline. The deeper concern: this is the latest in a documented lineage of Bluetooth dissector crashes in Wireshark going back years. Each gets patched in isolation, but the underlying condition — complex multi-byte Bluetooth command structures processed without systematic fuzz coverage — remains unaddressed. There's no CVE for 'fragile dissector infrastructure.' The question to carry forward is whether your Bluetooth analysis workflow depends on dissectors that have never been fuzzed, and whether that risk lives on your threat model.

Reviewed through automated stages and approved by a human before publication.