Wireshark CVE-2026-19696

Exploitation requires the target to be running Wireshark version 4.6.0 through 4.6.7 specifically on Windows. The user must actively open a crafted Ixia IxVeriWave or Vector Informatik BLF format file within Wireshark (UI:R - user interaction required). No authentication or elevated privileges are needed by the attacker. Limiting factors include: the Windows-only scope (Linux/macOS deployments are not affected per the description), the requirement for user interaction to open the malicious file, and the need for the attacker to have a delivery channel to the target user. The attack does not exploit a network-listening service and cannot be triggered remotely without social engineering.

The CVSS vector AV:L/AC:L/PR:N/UI:R reflects local, user-assisted exploitation with no privilege requirement - an attacker must deliver a crafted file and convince the user to open it in Wireshark. The High availability impact (A:H) reflects the crash/DoS outcome, while Low confidentiality and integrity impacts (C:L/I:L) suggest potential memory disclosure or minor corruption beyond the crash itself, though these are secondary signals. EPSS data is not provided in this intelligence package, so exploitation probability cannot be quantified. KEV status is not confirmed, and no POC is referenced. The practical risk is moderate: Wireshark is commonly used by network analysts and security researchers who frequently open files from untrusted sources, making social engineering delivery plausible in those contexts. The Windows-only scope limits exposure for Linux/macOS deployments. This is not a high-urgency remote exploitation scenario - a mid-sized analyst team should patch at next maintenance cycle rather than treating it as an emergency, but the real-world delivery vector (emailed or shared capture files) is realistic enough to warrant tracking.

An attacker crafts a malformed IxVeriWave or BLF capture file and delivers it to a network analyst via email, file share, or download link. The analyst opens the file in Wireshark 4.6.x on Windows, triggering an out-of-bounds write in the affected parser, crashing Wireshark. Repeated delivery could disrupt analysis workflows; secondary C:L/I:L impacts suggest possible limited memory disclosure or state corruption alongside the crash.