Wireshark CVE-2025-11626

Exploitation requires a user to open or load attacker-controlled data containing a MongoDB/MONGO protocol stream (a crafted capture file, or live/piped traffic) into a vulnerable Wireshark build - versions 4.4.0 through 4.4.9 or 4.2.0 through 4.2.13. The MONGO dissector must process the malformed data to trigger the infinite loop. Limiting factors that substantially reduce real-world risk: the vector is local (AV:L), exploitation requires explicit user interaction (UI:R) to load the malicious input, impact is limited to availability only (no code execution, no data disclosure), and only specific version ranges are affected - upgrading past 4.4.9/4.2.13 removes exposure.

All signals converge on this being a genuine but low-priority issue. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local, low-complexity attack requiring user interaction, with impact confined entirely to availability (C:N/I:N) - consistent with a crafted-input crash/hang of the Wireshark application rather than a remotely exploitable service flaw. The CWE-835 (infinite loop) classification matches the description precisely. EPSS is very low (0.12%, 2nd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation, and no public exploit (POC) is referenced in the provided data - this is 'no public exploit identified at time of analysis.' There are no conflicting signals: the low EPSS, absence of KEV, local attack vector, and availability-only impact all agree this is a nuisance-grade denial-of-service in an analyst tool, not a priority remote-code-execution threat. Note the vector is AV:L with UI:R, meaning a victim must actively load attacker-supplied data into Wireshark - this is not network-reachable self-propagating exploitation.

An attacker crafts a malformed packet capture (or live traffic containing a specially-formed MongoDB/MONGO protocol stream) and convinces an analyst to open it in a vulnerable Wireshark build (4.4.0-4.4.9 or 4.2.0-4.2.13). When the MONGO dissector parses the data it enters an infinite loop, hanging the application until forcibly terminated. No public exploit is identified in the provided data; the AV:L/UI:R profile means the attack succeeds only once the victim loads the crafted input.