Wireshark CVE-2026-15168

Exploitation requires the victim to be running Wireshark 4.6.0-4.6.6 or 4.4.0-4.4.16 and to actively open a specially crafted BLF file within the application (UI:R - active user interaction is mandatory). The BLF parser must be invoked, meaning the file must be opened through Wireshark's UI or passed via command-line argument. High attack complexity (AC:H) indicates that successful exploitation likely depends on specific memory layout or heap state conditions that are not reliably reproducible across environments. Limiting factors: no remote network exploitation path exists (AV:L); the attacker cannot trigger parsing without the user's action; impact is confined to confidentiality only (C:L), with no integrity or availability impact; and the memory disclosure is constrained to whatever resides in uninitialized memory at the time of parsing, which may not contain attacker-useful data in all cases.

All available signals converge on low real-world risk. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) scores 2.5, reflecting that exploitation is local-only, high-complexity, requires user interaction, and yields only limited confidentiality impact with no integrity or availability consequence. No EPSS data was included in the provided intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists, and no public proof-of-concept has been identified, indicating this has not attracted active exploitation activity. The high attack complexity (AC:H) suggests memory-layout-dependent conditions that reduce reliability of exploitation even when a malicious file is delivered. The practical threat model is narrow: an attacker must craft a file, socially engineer a Wireshark analyst into opening it, and then extract any leaked memory content from the UI output - a multi-step, low-yield chain. This is not a high-priority remediation item for most organizations, though analyst workstations handling sensitive captures warrant attention.

An attacker targeting an automotive or embedded systems analyst crafts a malicious BLF capture file and delivers it via email, shared drive, or a compromised data-sharing workflow. When the analyst opens the file in an affected Wireshark version, the BLF parser reads from uninitialized memory, and residual process memory - potentially including fragments of prior capture sessions or other sensitive in-memory data - is exposed in Wireshark's parsed output. No public proof-of-concept exploit has been identified at time of analysis, and the high attack complexity reduces the reliability of this scenario even when a delivery path exists.