Wireshark CVE-2026-15171

Exploitation requires that the victim is running Wireshark version 4.4.0-4.4.16 or 4.6.0-4.6.6 with the SSH protocol dissector enabled (enabled by default). The user must actively open or analyze a capture source containing specially crafted SSH protocol data - either by opening a malicious .pcap/.pcapng file or by performing a live capture on a network segment where an attacker can inject malformed SSH packets. User interaction is confirmed required (UI:R in CVSS vector). No authentication to Wireshark or the system is required (PR:N), but the local attack vector (AV:L) means the attacker cannot directly trigger the crash without the user's participation. Exploitation is limited to denial of service (process crash) with no path to code execution, data disclosure, or integrity impact. Versions 4.4.17 and above, and 4.6.7 and above, are not affected.

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects the constrained exploitation scenario. The local attack vector and mandatory user interaction (UI:R) are the primary risk reducers - an attacker cannot remotely trigger this; a user must actively open a malicious capture file or analyze adversarially crafted live traffic. Impact is confined entirely to availability (application crash); no confidentiality or integrity compromise is possible per C:N/I:N. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no POC exploit code has been identified. Real-world priority is low-to-medium: the product is widely deployed in security operations centers and engineering teams, but the exploit path requires social engineering or a malicious pcap delivery, making mass exploitation unlikely. Security teams performing regular triage of captured traffic from untrusted networks carry slightly elevated risk.

An attacker packages a specially crafted .pcap file containing malformed SSH protocol data designed to reach the null pointer dereference in Wireshark's SSH dissector, then delivers it to a security analyst via email, a ticketing system attachment, or a shared file repository under a plausible label such as 'suspicious_traffic_capture.pcapng'. When the analyst opens the file in an affected Wireshark version, the SSH dissector crashes the application, interrupting ongoing analysis. No public exploit code is known at time of analysis, so this scenario currently requires independent crafting of a triggering payload.