ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

A flaw was found in Wireshark. A remote attacker could exploit a buffer over-read vulnerability in the ERF (Extensible Record Format) file parser. This could lead to a denial of service, making the application unavailable to legitimate users.

Red Hat Enterprise Linux 6 through 9 ship Wireshark versions 1.x through 3.x, which predate the introduction of the vulnerable code in version 4.4.0 and are therefore not affected by this flaw. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS ship Wireshark 4.4.2, which is within the affected range (4.4.0–4.4.17). Avoid opening ERF (Extensible Record Format) capture files from untrusted or unknown sources in Wireshark. Red Hat Enterprise Linux 10 Fix deferred wireshark Red Hat Enterprise Linux 6 Not affected wireshark Red Hat Enterprise Linux 7 Not affected wireshark Red Hat Enterprise Linux 8 Not affected wireshark Red Hat Enterprise Linux 9 Not affected wireshark https://www.cve.org/CVERecord?id=CVE-2026-76884 https://nvd.nist.gov/vuln/detail/CVE-2026-76884 https://gitlab.com/wireshark/wireshark/-/work_items/21415 https://www.wireshark.org/security/wnpa-sec-2026-72.html