Wireshark CVE-2026-15170

User interaction is required (UI:R per CVSS vector) - the victim must actively open a crafted packet capture file or have Wireshark actively dissecting live Z39.50 traffic on a monitored interface. The attack vector is local (AV:L), meaning the attacker must either place a malicious file on the victim's filesystem or deliver it via phishing/shared storage, or inject malformed Z39.50 packets onto a network segment being passively captured. No authentication or special system privileges are required (PR:N). The Z39.50 dissector must be enabled (it is enabled by default in standard Wireshark installations). Exploitation is bounded by scope:unchanged (S:U) - only the Wireshark process is affected, with no lateral impact to the underlying OS or other applications.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H scores 5.5 (Medium), reflecting that exploitation is local in attack vector, requires user interaction (opening a crafted file or observing live traffic), carries no privilege requirement, is unscoped (Wireshark process only), and yields availability impact exclusively. There is no confidentiality or integrity consequence. No EPSS score was supplied, and the absence of a CISA KEV listing and no known POC code suggests this is not currently targeted by threat actors. The real-world priority is moderate: this is a crasher affecting an analyst tool, not a server-side service, so the operational blast radius is limited to disrupting capture sessions. Organizations running automated Wireshark-based pipeline analysis (e.g., CI-integrated PCAP inspection) face a slightly elevated risk due to potential automated ingestion of untrusted capture files.

An attacker crafts a malicious PCAP file embedding a malformed Z39.50 PDU and delivers it to a network analyst via email or a shared repository, then convinces the analyst to open it in a vulnerable Wireshark version, triggering the heap overflow and crashing the application. Alternatively, on a network segment where Z39.50 services (library catalog systems) are actively monitored, an attacker with network access could inject crafted Z39.50 packets to crash an analyst's live capture session. No public exploit code has been identified at time of analysis.