# CVE-2026-76921: Wireshark CMS protocol dissector heap-use-after-free

Source: https://junglewise.ai/threats/cve-2026-76921-wireshark-cms-protocol-dissector-heap-use-after-free  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76921 · Severity: medium · CVSS 5.5 · Published 2026-08-19

Wireshark is a network protocol analyzer widely used to capture and examine network traffic. The CMS (Cryptographic Message Syntax) dissector contains a use-after-free flaw that allows an attacker to crash Wireshark by sending specially crafted network packets. An attacker can exploit this vulnerability by opening a malicious packet capture file or by sending crafted LDAP packets over a network, causing the application to crash and denying service to legitimate users.

Technologies: [Wireshark](https://junglewise.ai/threats/technologies/wireshark). Vendors: [Wireshark](https://junglewise.ai/threats/vendors/wireshark).

## Quick answers

**Is CVE-2026-76921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76921 being exploited in the wild.

**How severe is CVE-2026-76921?** Medium severity, with a CVSS score of 5.5, published 19 August 2026.

**Which products and versions are affected?** Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.7.

**Is there a fix for CVE-2026-76921?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76921 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-76921?** Check whether you run Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free bug (CWE-416) in Wireshark's CMS protocol dissector that stores packet-scoped tree pointers in file-static variables (cap_tree and top_tree). After a packet's memory pool is reset, these non-NULL pointers remain and are reused by subsequent packets, causing heap-use-after-free conditions when RC2 parameter decoding or eContent callbacks attempt to append text to or dispatch through freed proto_item structures. The flaw affects versions 4.6.0–4.6.7 and 4.4.0–4.4.18. Attack vectors include opening a crafted PCAP file (requires user interaction) or live packet dissection over LDAP/UDP (no interaction needed). The crash is deterministic and confirmed via ASan heap-use-after-free reports in proto_item_append_text() and call_dissector_work(). Patches moving these pointers into packet-scoped cms_private_data structures are available.

## Affected products

- Wireshark Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.7

## Timeline

- 2026-08-19: disclosed

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21457](https://gitlab.com/wireshark/wireshark/-/work_items/21457)
- [https://gitlab.com/wireshark/wireshark/-/work_items/21458](https://gitlab.com/wireshark/wireshark/-/work_items/21458)

## Related threats

- [Wireshark USB HID dissector infinite loop in Usage range parsing](https://junglewise.ai/threats/cve-2026-96421-usb-hid-protocol-dissector-infinite-loop-and-memory-leak-in-4-6-0)
- [Wireshark pcapng file parser heap out-of-bounds read](https://junglewise.ai/threats/cve-2026-76929-wireshark-pcapng-file-parser-heap-out-of-bounds-read)
- [Wireshark Kerberos dissector heap buffer overflow](https://junglewise.ai/threats/cve-2026-76924-wireshark-kerberos-dissector-heap-buffer-overflow)
- [Wireshark ESS protocol dissector crash via uninitialized pointer](https://junglewise.ai/threats/cve-2026-76919-wireshark-ess-protocol-dissector-crash-via-uninitialized-pointer)
- [Wireshark SSH dissector heap buffer overflow in curve25519](https://junglewise.ai/threats/cve-2026-76918-wireshark-ssh-dissector-heap-buffer-overflow-in-curve25519)