CVE-2026-76886

CVE-2026-76886 is a Wireshark dissector crash in the C12.22 utility metering protocol, present in versions 4.4.0-4.4.18 and 4.6.0-4.6.7. The version asymmetry is the most instructive detail: 19 affected versions in the 4.4.x branch versus 8 in 4.6.x. This strongly suggests either the vulnerable code path was introduced later in the 4.6 cycle, or a partial fix landed in 4.4.x that never propagated to 4.6.x. Either scenario points to a gap in regression testing for a dissector that processes untrusted network captures. The C12.22 dissector relies on ASN.1 BER/TLV parsing infrastructure shared across SNMP, LDAP, X.509, and dozens of other protocols. When a dissector crashes on a variable-length field, the critical question is whether the failure originated in dissector-specific logic or in those shared TLV routines. If it's the latter, this crash is a proxy for unpatched paths in every dissector using that infrastructure—a symptom patch on C12.22 leaves the underlying parsing assumptions untouched. The CVSS 8.1 is notable. Dissector crashes typically score 5-6; an 8.1 suggests either controlled memory disclosure or a crash that can be shaped into information leakage, not merely denial of service. This reframes the risk: investigators running Wireshark on suspicious captures during incident response aren't just losing their diagnostic tool—they may be exposing their analysis workstation. Your priority: verify whether the patch addresses the root cause (the invalid parsing assumption) or only the specific trigger condition. Examine the commit diff when available. If it's a two-line bounds check without addressing why malformed input could reach that code path, assume the attack surface persists under different trigger conditions. Additionally, inventory any packet archives you maintain that may contain C12.22 captures—older Wireshark versions used against historical evidence retain the vulnerability, creating a persistent exposure in your evidence chain.

Reviewed through automated stages and approved by a human before publication.