Wireshark CVE-2026-15166

Exploitation requires active user interaction (UI:R): the victim must open a specially crafted packet capture file in Wireshark, or perform a live IEEE 802.11 capture that includes a malicious frame injected by a proximate attacker. The attack vector is local (AV:L), meaning the attacker cannot directly trigger the crash over the network - they must deliver the malicious file to the victim's filesystem or be within radio range to inject 802.11 frames. No attacker privileges are required (PR:N). The vulnerability is limited to denial of service (application crash only); remote code execution has not been demonstrated and is not supported by available data. Exploitation is further constrained to Wireshark versions 4.6.0-4.6.6 and 4.4.0-4.4.16 specifically.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects the constrained threat model: the local attack vector (AV:L) and mandatory user interaction (UI:R) substantially limit exploitation reach. A network-remote attacker cannot directly trigger the crash - they must first induce a user to open a malicious capture file or capture live traffic containing crafted 802.11 frames. Impact is exclusively availability (A:H - application crash); there is no confidentiality or integrity impact (C:N/I:N), meaning this cannot be leveraged for data exfiltration or code execution based on available data. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified precisely. The absence of a CISA KEV listing and lack of confirmed public exploit code suggest opportunistic mass exploitation is unlikely. Real-world priority is low for most organizations unless Wireshark is routinely used to analyze untrusted or externally sourced capture files, such as in incident response or malware analysis workflows.

An attacker crafts a malicious IEEE 802.11 packet capture file containing a specially constructed frame designed to trigger the stack buffer overflow in Wireshark's 802.11 dissector, then delivers it to a network analyst or security researcher via email, file share, or a malicious download. The analyst opens the file in a vulnerable version of Wireshark, causing an immediate application crash. No public proof-of-concept code is confirmed, but the deterministic nature of a stack-based buffer overflow in a file parser makes PoC development achievable for a skilled researcher.