Skip to main content

Wireshark CVE-2025-9817

HIGH
NULL Pointer Dereference (CWE-476)
2025-09-03 cve@gitlab.com
Denial Of Service Null Pointer Dereference Wireshark
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed SSH packets or capture file
  2. Exploit
    Deliver to analyst via capture or shared pcap
  3. Execution
    Wireshark SSH dissector dereferences NULL pointer
  4. Impact
    Application crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires an analyst to run an affected Wireshark version (4.4.0 through 4.4.8) and to either live-capture attacker-crafted SSH traffic or open a malicious capture file that reaches the SSH dissector. The vulnerability is triggered only when the SSH dissector parses the crafted packets; there is no persistent service exposure, and impact is confined to crashing the Wireshark process (availability only). Not applicable to versions at or above the 4.4.9 fix.
Impact

This is a genuine but low-priority issue: a NULL pointer dereference (CWE-476) in Wireshark's SSH dissector that crashes the application, yielding availability-only impact (C:N/I:N/A:N→A:H). The CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is driven entirely by the A:H availability metric; there is no confidentiality or integrity exposure and no code execution. Real-world exploitation signals are weak and consistent with each other: EPSS is 0.03% (9th percentile), the CVE is not in CISA KEV, and no public exploit code is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The AV:N rating is technically defensible because malicious SSH packets traverse the network, but in practice the crash occurs only inside an analyst's Wireshark process when that traffic is captured or a crafted capture file is opened, so the effective impact is a local tool crash rather than a service outage. A patch is available from the vendor (fixed in the 4.4.9 line per wnpa-sec-2025-03), and downstream fixes exist from Red Hat and SUSE, indicating broad vendor acknowledgement. Net: a real, well-documented bug but low real-world risk - a crash of an analysis tool, not a server compromise.
Exploit ScenarioDerived

An attacker crafts malformed SSH protocol traffic (or a malicious .pcap capture file) that triggers a NULL pointer dereference in Wireshark's SSH dissector; when an analyst captures that traffic or opens the file in an affected version (4.4.0-4.4.8), Wireshark crashes. No public proof-of-concept is referenced, and impact is limited to denial of service of the analysis session with no code execution or data exposure.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 26, 2026

NULL pointer dereference in Wireshark's SSH dissector crashes the application when it processes a crafted SSH packet, affecting versions 4.4.0 through 4.4.8 and yielding availability-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5). The fault requires the victim - typically a network analyst - to either live-capture attacker-crafted SSH traffic or open a malicious capture file that reaches the SSH dissector; there is no persistent service exposure, and exploitation is limited to terminating the Wireshark process. Unauthenticated remote attackers can supply the malformed traffic (PR:N per the assessed vector), but the practical risk is low: no public exploit has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.03% (9th percentile). Vendor-released fixes exist in Wireshark 4.4.9, with downstream packaged updates from Red Hat and SUSE.

Earlier versions of this analysis (1)
v1 Mar 28, 2026 - 19:10 CVSS 7.8

SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

RemediationAI

Vendor-released patch: upgrade to Wireshark 4.4.9 or later, which resolves the SSH dissector NULL pointer dereference; the fix is documented in wnpa-sec-2025-03 (https://www.wireshark.org/security/wnpa-sec-2025-03.html) and the upstream issue 20642 (https://gitlab.com/wireshark/wireshark/-/issues/20642). Where Wireshark is managed by the operating system, apply the distribution packages instead of a manual build: Red Hat users should install the versions from RHSA-2026:1714 or RHSA-2026:2763 (https://access.redhat.com/errata/RHSA-2026:1714, https://access.redhat.com/errata/RHSA-2026:2763) and SUSE users the versions from SUSE-SU-2025:03294, SUSE-SU-2026:1169, or SUSE-SU-2026:20222. If immediate upgrading is not possible, the exposure is limited to the analysis workflow, so restrict the risk by refusing to open capture files from untrusted sources and by capturing only on trusted segments with pre-filtered capture filters - this reduces the chance of attacker-crafted SSH traffic reaching the dissector but does not fix the defect, and it degrades triage fidelity for incident responders who need to inspect hostile captures. Running Wireshark as an unprivileged user (rather than with elevated capture privileges) limits the consequence of the crash to loss of the analysis session; note that this is a containment measure, not a substitute for the 4.4.9 upgrade.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Wireshark is a packet capture and protocol analysis tool that dissects network traffic through per-protocol parsers, one of which handles the SSH protocol (RFC 4253 transport layer and its binary packet structure). The flaw is a CWE-476 NULL pointer dereference: malformed SSH data causes the dissector to follow a pointer that has not been initialized, aborting the process. Because dissectors run in the analysis application rather than as a listening service, the attack surface is the capture pipeline - live interface capture or the loading of a saved pcap/pcapng file. The CPE data identifies the affected package as cpe:2.3:a:wireshark:wireshark with all 4.4.x builds in the affected range and the first remediated build appearing as version 4.4.9 (referenced in CPE as 4.4.9:rc0). The vulnerability was reported via cve@gitlab.com and tracked upstream as Wireshark issue 20642 under advisory wnpa-sec-2025-03; impact is confined to availability (C:N/I:N/A:H), so no data disclosure or modification is possible through this vector.

Know when Wireshark gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Malicious SSH packets are network-delivered and parsed with no auth or interaction beyond capture; only availability (dissector/app crash) is affected, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Updated
Sep 26, 2026 - 00:31 vuln.today
v2 - CVSS changed
CVSS changed
Sep 26, 2026 - 00:22 NVD
7.8 (HIGH) 7.5 (HIGH)
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Sep 03, 2025 - 08:15 nvd
HIGH 7.8

DescriptionNVD

SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service

Executive ViewAI

Why It Matters

Wireshark versions 4.4.0 through 4.4.8 contain an availability-only flaw in the SSH dissector that can crash the application when a network analyst opens a malicious capture file or processes crafted SSH traffic. The impact is limited to terminating the analyst's Wireshark process, with no confidentiality or integrity loss and no public exploit identified at time of analysis. Leadership should care because unpatched analyst workstations could face repeated disruption during incident response or forensic review, though the practical business risk is low.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Prevalence
High
Wireshark is the de facto network protocol analyzer used across security and IT teams
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)NVD

cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:4.4.9:rc0:*:*:*:*:*:*

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.2 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.27 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.29 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.14 Affected
Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-SAP-EC2 Affected
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1714 ADVISORY https://access.redhat.com/errata/RHSA-2026:2763 ADVISORY https://vuldb.com/vuln/322308 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03294/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1169/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20222/ REF https://gitlab.com/wireshark/wireshark/-/issues/20642 REF https://www.wireshark.org/security/wnpa-sec-2025-03.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy