Wireshark CVE-2026-19694

Exploitation requires that the victim is running Wireshark version 4.6.0 through 4.6.7 and actively opens a specially crafted TTX Logger file. The CVSS vector specifies UI:R (user interaction required) and AV:L (local attack vector), confirming that the malicious file must be present on the victim's system and the user must initiate parsing. AC:H indicates that crafting a file reliably triggering the heap overflow is non-trivial. Exploitation is limited by: the requirement for user interaction (victim must open the file), local file delivery (no remote network-triggered parsing path confirmed), high crafting complexity, and the lack of any code execution primitive - impact is strictly application crash. Non-default TTX Logger file association or analyst habit of opening unknown capture files increases exposure; environments that restrict parseable file types or use sandboxed Wireshark instances are materially less exposed.

The CVSS 3.1 base score of 4.7 (Medium) accurately reflects the constrained real-world risk of this vulnerability. The local attack vector (AV:L) requires the attacker to deliver a malicious TTX Logger file to the victim's system, and the user must actively open it (UI:R), creating a meaningful social engineering prerequisite. High attack complexity (AC:H) further indicates that reliable triggering of the heap overflow requires non-trivial crafting effort. The scope is unchanged (S:U), and there is no confidentiality or integrity impact - only application availability is affected, meaning Wireshark crashes but the underlying system is not compromised. No EPSS data was provided in the input, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. From an SSVC perspective, exploitation is not automated (requires file delivery and user action), technical impact is partial (application-level DoS only), and the vulnerability is not remotely triggerable without user interaction. This is a genuine medium-priority issue: meaningful for environments where analysts rely on Wireshark for continuous packet review, but not an emergency remediation item for most organizations. The absence of code execution potential keeps this well below critical triage thresholds.

An attacker crafts a malformed TTX Logger file designed to trigger an out-of-bounds heap write in Wireshark's TTX parser, then delivers it to a network analyst via email attachment, shared network drive, or download link. When the analyst opens the file in an affected version of Wireshark (4.6.0-4.6.7), the parser crashes, interrupting the analyst's session and potentially disrupting ongoing traffic analysis workflows. No public proof-of-concept exploit code has been identified at time of analysis.