# CVE-2026-19696: Wireshark out-of-bounds write in phtoleu16 helper

Source: https://junglewise.ai/threats/cve-2026-19696-wireshark-out-of-bounds-write-in-phtoleu16-helper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19696 · Severity: medium · CVSS 6.6 · Published 2026-08-13

Wireshark is a widely-used network traffic analysis tool for inspecting packet data. On Windows systems built with MSVC or Intel compilers, a bug in the packet writing helper function causes it to write 4 bytes instead of the intended 2 bytes, corrupting adjacent memory. An attacker can exploit this via a malformed network capture file (like VWR or NetMon format) to crash Wireshark or potentially execute code on systems processing untrusted packet captures.

Technologies: [Microsoft Windows](https://junglewise.ai/threats/technologies/windows), [Wireshark](https://junglewise.ai/threats/technologies/wireshark). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Wireshark](https://junglewise.ai/threats/vendors/wireshark).

## Quick answers

**Is CVE-2026-19696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19696 being exploited in the wild.

**How severe is CVE-2026-19696?** Medium severity, with a CVSS score of 6.6, published 13 August 2026.

**Which products and versions are affected?** Wireshark 4.6.0 to 4.6.7.

**Is there a fix for CVE-2026-19696?** A patch was published on 2026-08-13: Fix released in Wireshark 4.6.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19696 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-19696?** Check whether you run Microsoft Windows or Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds write (CWE-787) in the optimized MSVC/Intel implementation of the `phtoleu16()` helper function in `wsutil/pint.h`. The function is documented and used as a 2-byte little-endian store but uses a 32-bit parameter and calls `memcpy(p, &v, sizeof(v))` which copies 4 bytes. The bug affects only MSVC without clang-cl, Intel Classic, or Intel LLVM builds; GCC/Clang portable implementations are unaffected. Attack vectors include parsing malformed VWR S3 WLAN RF capture files and NetMon format exports; callers also include RTP audio export functionality. The overflow is deterministic on affected builds and can corrupt stack or heap-allocated 2-byte objects. A patch changing the parameter to `uint16_t` and using `sizeof(v)` correctly fixes the issue. Wireshark 4.6.8 or later resolves this.

## Affected products

- Wireshark Wireshark 4.6.0 to 4.6.7

## Timeline

- 2026-08-12: disclosed
- 2026-08-13: patched: Fix released in Wireshark 4.6.8

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21455](https://gitlab.com/wireshark/wireshark/-/work_items/21455)
- [https://www.wireshark.org/security/wnpa-sec-2026-82.html](https://www.wireshark.org/security/wnpa-sec-2026-82.html)

## Related threats

- [Windows BitLocker heap buffer overflow with physical attack](https://junglewise.ai/threats/cve-2026-97015-heap-based-buffer-overflow-in-windows-bitlocker-allows-an)
- [Microsoft Windows Shell type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-97013-access-of-resource-using-incompatible-type-type-confusion-in)
- [Microsoft Windows VMSwitch out-of-bounds read privilege escalation](https://junglewise.ai/threats/cve-2026-97002-out-of-bounds-read-in-windows-vmswitch-allows-an-authorized)
- [Microsoft Windows USM Communication Manager null pointer dereference](https://junglewise.ai/threats/cve-2026-97000-null-pointer-dereference-in-windows-usm-communication-manager)
- [Microsoft Windows Winsock use after free privilege escalation](https://junglewise.ai/threats/cve-2026-96994-use-after-free-in-winsock-allows-an-authorized-attacker-to)