Wireshark CVE-2026-15169

Exploitation requires that Wireshark actually dissect a crafted UMTS FP (UMTS Frame Protocol) packet - the attacker must get that packet into a capture the victim is analyzing, either by injecting it onto a network segment during a live capture or by supplying a malicious capture file the analyst opens. The UMTS FP dissector must be enabled (it is by default) and the running version must be in the 4.6.0-4.6.6 or 4.4.0-4.4.16 range. Limiting factors: the attacker does not directly control the victim's host, so exploitation depends on the target running a vulnerable Wireshark and choosing to capture or open the malicious traffic; impact is confined to a crash (availability only) with no code execution, data disclosure, or persistence, and SSVC marks it not Automatable.

The signals are internally consistent and point to a moderate, availability-only issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 driven entirely by the A:H impact - there is no confidentiality or integrity exposure and no code execution claimed, only a crash. SSVC reinforces this: exploitation is only 'poc' (not active), Automatable is 'no', and Technical Impact is 'partial', so CISA's framework would not push this to immediate action. EPSS is low (0.14%, 4th percentile) and the CVE is absent from KEV, so there is no evidence of in-the-wild use. The main nuance is the PR:N/UI:N scoring: in practice a victim must actually capture or open the malicious traffic, so real-world exploitability is gated by whether an attacker can reach a monitored capture session - this makes the network vector somewhat more conditional than the raw vector suggests. Net: a legitimate patch-in-normal-cycle item, not a drop-everything event.

An attacker crafts a malformed UMTS FP frame and either injects it onto a network segment where an analyst is running a live Wireshark capture, or delivers it inside a capture file shared with the analyst. When Wireshark's UMTS FP dissector parses the frame, the heap buffer overflow triggers and the application crashes, interrupting the analyst's monitoring or investigation. Publicly available exploit code exists, and given AC:L the crash is straightforward to reproduce once the frame reaches the dissector.