Wireshark CVE-2026-15174

Exploitation requires that the victim is running Wireshark 4.6.0-4.6.6 or 4.4.0-4.4.16 and actively opens or processes a capture file containing crafted Catapult DCT2000 protocol data. The CVSS vector AV:L/UI:R confirms both conditions: local file access and explicit user-initiated action are mandatory prerequisites. The Catapult DCT2000 dissector must be enabled (it is enabled by default in standard Wireshark builds). No authentication or network exposure is required on the victim's system, but the attacker must successfully deliver the malicious file to the target through a social engineering channel. Exploitation is limited to desktop or interactive Wireshark sessions - headless or automated tshark pipelines processing untrusted files without user interaction represent a secondary risk surface not directly addressed by the CVSS UI:R rating.

CVSS 5.5 Medium accurately reflects the constrained exploitability: the local attack vector (AV:L) and required user interaction (UI:R) mean this cannot be triggered remotely or passively - a victim must open a crafted file. Impact is limited entirely to availability (A:H, C:N, I:N), making this a tool disruption rather than a data breach or lateral movement primitive. No EPSS score was included in the provided intelligence, and the vulnerability does not appear in CISA KEV, indicating no confirmed active or widespread exploitation. The niche protocol affected (Catapult DCT2000, primarily relevant to telecom testing environments) further limits the realistic attacker population motivated to weaponize this. Real-world priority is low-to-moderate: security analysts and developers who routinely open third-party or customer-provided capture files face the most tangible risk, while automated or server-side Wireshark deployments with no user interaction are unaffected.

An attacker crafts a malicious Catapult DCT2000 capture file engineered to overflow the heap buffer during dissection, then delivers it to a target analyst via email attachment, a bug bounty submission portal, or a shared network drive. When the analyst opens the file in an affected Wireshark version, the DCT2000 dissector triggers the heap overflow, immediately crashing Wireshark and disrupting any active analysis session. No exploit code has been publicly identified, but the primitive - a file opened by a desktop application - is a straightforward social engineering vector.