CVE-2026-76880

CVE-2026-76880 is a crash in the RRC (Radio Resource Control) dissector affecting Wireshark 4.4.x and 4.6.x. The CVSS 7.5 score badly misrepresents the actual risk because it treats this as a generic denial-of-service—when the reality is that Wireshark itself becomes a weapon attackers can aim at the security researchers trying to analyze their traffic. The RRC dissector handles connection management messages between user equipment and LTE/5G networks. If an attacker can inject or manipulate cellular-adjacent traffic—whether through an IMSI catcher, rogue small cell, or man-in-the-middle on backhaul—they can crash any Wireshark instance analyzing that traffic on sight. The carried-forward pattern (affecting both 4.6.x stable and 4.4.x LTS) is the concerning signal here: the bug was inherited rather than introduced fresh, suggesting a latent structural issue in how RRC messages are parsed—likely a state machine edge case or memory handling flaw that exists across message types. What to do: ensure Wireshark is updated to 4.4.8 or later (LTS) and 4.6.6 or later (stable). But patching alone is insufficient—understand that your capture infrastructure may be the injection vector. If you're running Wireshark on traffic from commercial collectors, shared capture feeds, or any infrastructure you don't fully control, you're exposed to an attacker who can craft the specific RRC message sequence that triggers the crash. The attack surface is narrower than a generic dissector bug (it requires cellular protocol expertise), but it's precisely the population analyzing IMSI catchers, profiling rogue towers, or doing baseband firmware research who face adversaries with that capability. The deeper concern: Wireshark dissector patches rarely articulate the underlying failure mode in commit messages. This means the structural pattern that caused this crash cannot be audited across the other 1,700+ dissectors. Treat this as a class of vulnerability—analyst-targeted crashes—rather than an isolated incident.

Reviewed through automated stages and approved by a human before publication.