Wireshark CVE-2026-5404

Exploitation requires local file system access and user interaction to open a K12 RF5 format file in Wireshark. The attacker must convince or trick a user into opening a crafted .rf5 file. The K12 RF5 file parser is only invoked when the user explicitly opens a file with this format or when Wireshark auto-detects the format during file import. No network access, authentication, or elevated privileges are required to trigger the vulnerability once a malicious file is opened.

CVSS 4.7 with local attack vector (AV:L), high complexity (AC:H), no privileges required (PR:N), and user interaction required (UI:R) indicates moderate but not critical risk. The local-only attack vector significantly restricts real-world exploitation compared to network-based vulnerabilities. High complexity and mandatory user interaction (opening a malicious file) further limit practical attack surface. The denial of service impact (AV:H) affects availability but not confidentiality or integrity. While EPSS score and KEV status are not provided in the input data, the combination of local-only access, file-parsing trigger mechanism, and user interaction requirement suggests this is lower priority than network-reachable or unauthenticated remote vulnerabilities. Defenders should prioritize patching systems where users regularly open untrusted capture files or receive files from external sources.

An attacker crafts a malicious K12 RF5 capture file with specially formatted data that triggers a buffer overflow in Wireshark's parser. The attacker sends this file to a target user via email or file-sharing service. When the user opens the file in Wireshark to analyze network traffic, the parser crashes, denying the user access to network analysis functionality.