Wireshark CVE-2026-5299

Exploitation requires the attacker to supply a malicious packet capture file (pcap, pcapng, or similar format) containing a malformed ICMPv6 packet with the PvD option set. The vulnerability is triggered only when Wireshark parses this file - specifically, when the dissector processes the ICMPv6 PvD option structure. The user must manually open the file (no automatic parsing on receipt), and the file must reach the dissector (not filtered or blocked by capture settings). Default Wireshark configurations are vulnerable; no special feature enablement is required. Exploitation is NOT possible via network sniffing of live traffic unless Wireshark is configured to auto-open captures from the network, an atypical configuration.

This is a LOW-to-MODERATE real-world risk despite a moderate CVSS score of 5.5. The attack vector is LOCAL (AV:L), requiring the attacker to either place a malicious packet capture file on the target system or convince a user to open one - significant barriers in most environments. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly reflects that exploitation requires user interaction (UI:R, opening a file) but causes availability impact (A:H). No publicly identified exploit code, active exploitation, or CISA KEV listing is provided. The vulnerability is denial of service only - no remote code execution, privilege escalation, or data breach risk. Wireshark deployments used for passive network monitoring by trained analysts are at minimal risk; risk increases in environments where untrusted packet files are routinely processed or where availability of analysis tools directly impacts incident response. The lack of network attack vector eliminates risk to most Wireshark installations that capture traffic on local interfaces.

An attacker creates a malformed ICMPv6 packet capture file with a specially crafted PvD option that triggers infinite recursion in Wireshark's dissector. The attacker emails the file to a security analyst or places it on a shared network drive. When the analyst opens the file to investigate a suspected incident, Wireshark's parser enters an infinite loop, consuming CPU and causing the application to hang, disrupting incident response activities.