Wireshark CVE-2026-5405

Exploitation requires the victim to open a maliciously crafted network capture file (.pcap, .pcapng, or similar format) containing RDP protocol traffic in a vulnerable Wireshark version. The RDP dissector must be enabled (default configuration in standard Wireshark builds). Attack is limited to local context - attacker cannot exploit remotely over network; they must deliver the malicious file via email, file sharing, web download, or compromise of shared network monitoring repositories. User interaction is mandatory (UI:R in CVSS vector) - the file must be explicitly opened by the target. No authentication required (PR:N) means any user running Wireshark can be targeted regardless of privilege level. Exploitation likelihood increases in environments where analysts routinely process capture files from untrusted sources such as incident response teams, malware researchers, or shared threat intelligence platforms.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack requiring user interaction - attacker must convince a target to open a malicious capture file, limiting automated exploitation. This is not a remote network-based attack; it requires social engineering or supply chain compromise of shared capture files. The high impact ratings (C:H/I:H/A:H) reflect potential for full system compromise if code execution is achieved, but the local vector and user interaction requirement significantly reduce likelihood compared to remote unauthenticated vulnerabilities. No CISA KEV listing suggests this is not being actively exploited in targeted campaigns, though GitLab issue tracking indicates technical details are publicly documented. EPSS score unavailable, preventing probability-based prioritization. SSVC assessment: exploitation status appears to be proof-of-concept level (GitLab issue), not automatable due to user interaction requirement, but high technical impact (arbitrary code execution). Priority should focus on organizations where analysts frequently process untrusted capture files from external sources or incident response scenarios.

An attacker crafts a malicious pcap capture file containing specially formatted RDP protocol packets designed to trigger the heap overflow in Wireshark's dissector. They distribute this file via email to network security analysts or post it to public packet capture repositories used by researchers. When a target opens the file in vulnerable Wireshark versions, the RDP dissector processes the malformed packets, overwriting heap memory structures. The attacker achieves arbitrary code execution with the privileges of the Wireshark process, potentially installing backdoors or exfiltrating sensitive network captures containing credentials or proprietary data.