AISLE Discovers 16 CVEs in Wireshark, the World’s Most Popular Network Protocol Analyzer

Recently, we announced that our AI had discovered 6 CVEs in curl after both Mythos and Codex Security had found zero. Our blog sparked an interesting discussion on Hacker News, one that kept circling back to the question of methodology: how was AISLE, a startup based in the heart of Europe, finding vulnerabilities that frontier AIs missed?

This week, we’d like to use the occasion of our 16 CVE discoveries in Wireshark as a way to help answer this question. As the world’s most popular network protocol analyzer, Wireshark is downloaded over 20 million times each month, and its history dates back to 1998. That means that any vulnerabilities in Wireshark have evaded the notice of an active and enduring open-source community.

Several of our Wireshark findings, which include 4 high-severity vulnerabilities, are interesting in their own right, and we’ll be writing about them in the coming weeks. Today, we’ll share a video demonstration to show how one of the high-severity CVEs could be exploited to crash Wireshark, as well as some thoughts on how our AI is performing so well on code analysis and what that means for AI cybersecurity.

16 Wireshark CVEs

Of the 16 Wireshark CVEs credited to AISLE, 4 are high-severity issues, each of which is network-reachable without user interaction. All of these vulnerabilities could be exploited to crash Wireshark, disrupting packet analysis and potentially allowing malware onto a device.

4 high severity findings

CVE-2026-76886 — C12.22 dissector (8.1): A heap-based buffer overflow in Wireshark's parser for the C12.22 smart-metering protocol, triggered by a malformed packet. When specific memory-layout conditions are met, this lets an attacker alter data that is not intended to be writable.

CVE-2026-76879 — C12.22 dissector (7.5): A separate stack-based buffer overflow in the same C12.22 protocol dissector. A crafted packet writes past a stack buffer, causing a denial-of-service crash.

CVE-2026-76880 — RRC dissector (7.5): An out-of-bounds write in the dissector for the RRC cellular signaling protocol. A malicious packet pushes the parser to write outside its intended memory bounds, crashing Wireshark.

CVE-2026-76928 — X.509IF dissector (7.5): A NULL pointer dereference in the X.509IF (X.509 information framework) dissector. Malformed input leads the code to dereference a null pointer and crash the application.

While our full technical writeup is pending, we did replicate CVE-2026-76886 crashing Wireshark and disrupting analysis. Here’s the video:

The medium and low findings, listed in order of severity rating

• CVE-2026-19696 — BLF file parsing, out-of-bounds read (6.6)
• CVE-2026-76921 — CMS protocol dissector, use-after-free (5.5)
• CVE-2026-76923 — Bluetooth HFP Profile dissector, out-of-bounds read (5.5)
• CVE-2026-76924 — Kerberos protocol dissector, out-of-bounds read (5.5)
• CVE-2026-76922 — Bluetooth BR/EDR FHS protocol dissector, NULL pointer dereference (5.5)
• CVE-2026-15171 — SSH protocol dissector, NULL pointer dereference (5.5)
• CVE-2026-76919 — ESS protocol dissector, use of uninitialized variable (5.3)
• CVE-2026-76929 — Pcapng file parser, out-of-bounds read (4.7)
• CVE-2026-76881 — CMS protocol dissector, NULL pointer dereference (4.7)
• CVE-2026-76927 — H.245 protocol dissector, NULL pointer dereference (4.7)
• CVE-2026-76920 — phone log file parser, out-of-bounds write (4.7)
• CVE-2026-76926 — BUSMASTER file parser, reachable assertion / abnormal exit (3.1)

Because Wireshark is an essential part of the infrastructure powering digital communications, these findings are significant in and of themselves. If your team uses Wireshark, we strongly recommend you update to the latest version.

What This Means for AI Cybersecurity

In the context of the debate among AI innovators and cybersecurity practitioners, the importance of these vulnerabilities goes beyond Wireshark users. In essence, they are another clear sign that the debate between frontier AI and specialized engineering can be put to rest.

At least since Anthropic announced that it had created Mythos, a model too dangerous to release to the public, cybersecurity practitioners have faced a choice: hand off security tasks to a frontier lab using the traditional SaaS model (with all its sovereignty headaches), or entrust them to a specialized, multi-model system.

Each side has sensible arguments. Frontier labs have access to virtually unlimited resources, and they can apply their expertise in machine learning to the hard problems of cybersecurity. Yet in many complex domains, including medicine, mathematics, and, indeed, cybersecurity, specialist AI systems have long outperformed higher-powered models.

The research

We believe AISLE is a case in point. Rather than being tethered to a single, proprietary AI, our platform is engineered to automatically route security tasks to the best model for each job.

As AISLE Chief Scientist Stanislav Fort wrote in April, the AI cybersecurity workflow is composed of multiple discrete steps. To succeed, AI solutions must navigate large codebases to identify the functions worth examining, detect vulnerabilities, triage and verify them, generate patches, and test those patches to validate that the issue has actually been fixed.

There is no reason to assume that one model will be the best at each of these distinct tasks. Indeed, both publicly available research and AISLE’s track record show that routing tasks to the optimal model leads to better results, at far lower costs, than sending everything through the most powerful LLM. As Fort put it, “a single brilliant model may reason more deeply about each piece of code, but a much cheaper model can look at literally every piece of code.”

The record so far

We started using AISLE to find vulnerabilities in vital open-source codebases like Wireshark in August 2025. Just over a year later, our AI has received more than 375 CVEs across codebases such as OpenSSL, Cursor, and MySQL.

In fact, according to an independent review of agentic security systems from UC Berkeley, AISLE currently leads all AI cybersecurity products in CVE total, CWE-breadth, MITRE-Top 25 reach, and OWASP reach.

The AISLE difference boils down to our focus on thoughtful engineering, as opposed to brute-force computing. By building a harness that steers AI models towards the tasks they excel at, we deliver the combination of broad coverage and deep analysis that are essential for complex cybersecurity workloads.

And because the system is independent of any single model, we can serve it in on-prem or air-gapped environments for data that has to stay within your control.

See What AISLE Finds in Your Code

Skeptical? The same discovery engine that powered our findings in Wireshark (and curl) is available as a one-time AI code audit: AISLE Snapshot. See what our AI finds in your code, wherever it lives: air-gapped, on-prem, or in the cloud. Get your Snapshot.