Wireshark CVE-2026-15163

Exploitation requires that Wireshark actually dissect attacker-influenced data using one of the affected protocol dissectors (tracked in GitLab work items 21275, 21277, 21330, 21383) - either by capturing crafted packets live or by the analyst opening a malicious capture file. Per the CVSS vector no authentication or user interaction is scored (PR:N/UI:N), but the practical limiting factor is that Wireshark is an analyst-run application rather than an always-on network service, so the attacker must get their traffic in front of a running capture or persuade the victim to load a hostile file. Only versions 4.6.0-4.6.6 and 4.4.0-4.4.16 are affected; other branches and the patched 4.6.7/4.4.17 releases are not.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) reflects a network-reachable, unauthenticated, low-complexity attack whose entire impact is availability - no confidentiality or integrity loss. Multiple independent signals converge on LOW real-world priority despite the 'High' rating: EPSS is only 0.12% (2nd percentile), CISA SSVC records Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no public exploit or KEV listing. The main caveat is that AV:N assumes an attacker can deliver packets to a live capture or induce the victim to open a malicious capture file; in practice Wireshark is an analyst desktop tool rather than a network service, so exposure is more constrained than the network vector suggests. Bottom line: a genuine bug worth patching in the normal cycle, but not an emergency - the impact ceiling is a crash/hang, not compromise.

An attacker crafts a malformed packet for one of the affected protocols and either injects it onto a network segment an analyst is actively capturing, or sends a booby-trapped .pcap/.pcapng file for the analyst to open. When Wireshark dissects the packet, the vulnerable dissector enters an infinite loop and the application hangs, denying the analyst use of the tool. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or configuration is required once the packet reaches the dissector.