Wireshark CVE-2026-19695

Exploitation requires that the target user actively open a specially crafted Gammu DCT3 trace file using Wireshark version 4.6.0 through 4.6.7 on a local system (AV:L, UI:R). The high attack complexity (AC:H) indicates that successful exploitation is not guaranteed on every attempt and likely depends on precise buffer layout or specific environment conditions. No attacker privileges are required - the malicious file can be crafted and delivered by anyone. Exploitation is further narrowed by the niche use case: Gammu DCT3 trace files are associated with Nokia DCT3-series legacy mobile phone diagnostics, so the realistic victim population is primarily telecom researchers, GSM security analysts, and developers testing legacy Nokia protocol tooling. The impact is strictly limited to a Wireshark process crash (denial of service); confidentiality and integrity of the underlying system are unaffected (C:N/I:N). Automated Wireshark pipelines that ingest trace files without human review eliminate the UI:R barrier and represent an elevated-risk deployment pattern.

The CVSS 3.1 score of 4.7 (Medium) accurately reflects constrained real-world risk. The local attack vector (AV:L) limits exploitation to scenarios where the attacker delivers a crafted file to a user who opens it manually in Wireshark - no remote code path exists. High attack complexity (AC:H) suggests additional preconditions or precision requirements beyond a simple file open. User interaction (UI:R) is mandatory and the scope is unchanged (S:U), meaning only the Wireshark process is affected. Impact is restricted entirely to availability (A:H - crash), with no confidentiality or integrity consequence. No EPSS score was provided in the intelligence data. The vulnerability is absent from CISA KEV, and no public exploit code has been identified. The niche nature of Gammu DCT3 trace files further reduces realistic attacker interest: the primary targets would be security researchers, telecom network analysts, or developers working with legacy Nokia GSM phone traces - not general-purpose network operators. Overall this is a low operational priority for most organizations; elevated only in contexts where Wireshark is used in automated or scripted file-processing pipelines where user interaction assumptions may not hold.

An attacker crafts a malformed Gammu DCT3 trace file engineered to overflow the stack buffer in Wireshark's DCT3 parser. The file is delivered to a target analyst or researcher - plausibly via email, shared network drive, or a repository of test captures - who opens it in an affected Wireshark version (4.6.0-4.6.7), triggering a process crash and denial of service. No public exploit code has been identified at time of analysis, and the high attack complexity rating suggests exploitation may require precise file crafting beyond a simple proof-of-concept.