CVE-2026-7376
Published: 30 April 2026
Summary
CVE-2026-7376 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Wireshark Wireshark. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of the known NULL pointer dereference flaw in Wireshark sharkd via patching to prevent the DoS crash.
Protects against memory safety vulnerabilities like NULL pointer dereferences (CWE-476) that cause crashes in sharkd.
Ensures graceful error handling for conditions like NULL pointer dereferences to avoid system crashes and DoS in sharkd.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL pointer dereference in sharkd directly enables local crash for denial of service, matching Application or System Exploitation under Endpoint DoS.
NVD Description
Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Deeper analysisAI
CVE-2026-7376 is a vulnerability affecting the sharkd component in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. It stems from a NULL pointer dereference (CWE-476) that causes a crash, enabling a denial of service condition. The CVSS v3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating medium severity with high availability impact.
A local attacker can exploit this vulnerability under low attack complexity with no privileges required, but user interaction is necessary. Exploitation triggers a crash in the sharkd process, resulting in denial of service through high availability disruption, with no impacts on confidentiality or integrity.
Wireshark security advisory WNPA-sec-2026-48 provides details on the issue at https://www.wireshark.org/security/wnpa-sec-2026-48.html. Further discussion and resolution tracking are available in the Wireshark GitLab work item at https://gitlab.com/wireshark/wireshark/-/work_items/21206. Security practitioners should review these resources for patch availability and mitigation guidance.
Details
- CWE(s)