Wireshark CVE-2026-15172

The CVSS vector AV:L/UI:R confirms two hard requirements: the attack is local (the malformed input must reach Wireshark's dissector either via a crafted capture file opened by the user or via traffic injected on a locally monitored interface), and active user interaction is required (a victim must open the file or initiate a capture session that includes the malformed FMP/NOTIFY packets). No attacker privileges are required (PR:N), meaning anyone who can deliver a file to the victim qualifies. Exploitation is limited by: (1) the victim must be running Wireshark 4.6.0-4.6.6 or 4.4.0-4.4.16 specifically; (2) the victim must interact with the malicious input; (3) impact is limited to crashing the Wireshark process - no code execution or data exfiltration path is indicated.

The CVSS 3.1 score of 5.5 (Medium) reflects a constrained attack surface: AV:L indicates the exploit path runs through local file parsing or locally observed traffic rather than a direct network connection, and UI:R requires the victim to actively open or analyze the malformed input. Availability impact is High (application crash), but Confidentiality and Integrity are unaffected. No EPSS data was provided in the source intelligence, and neither a public proof-of-concept nor a CISA KEV listing exists at time of analysis, suggesting this has not been observed in active exploitation campaigns. The real-world priority is therefore moderate: primarily a concern for environments where analysts routinely open untrusted capture files from third parties. Organizations that restrict Wireshark to controlled, trusted capture sources face minimal residual risk after patching.

An attacker crafts a packet capture file (.pcapng or similar) containing malformed FMP/NOTIFY protocol packets designed to trigger the unchecked loop condition in the dissector. The file is delivered to a security analyst or network engineer - via email, a shared repository, or a compromised capture source - who opens it in an affected Wireshark version, causing the application to crash. No public exploit code has been identified at time of analysis, so successful exploitation currently depends on independent re-discovery of the triggering input.