Wireshark CVE-2026-5407

Exploitation requires three specific conditions: (1) User must open a malicious PCAP file or live network capture containing crafted SMB2 packets in Wireshark - the vulnerability is not remotely triggerable against Wireshark instances running on other systems but rather requires local file access or live capture privileges on the same host; (2) The capture must contain valid SMB2 protocol framing that triggers the dissector code path - random packets or non-SMB2 traffic will not trigger the vulnerability; (3) Wireshark must be actively processing the capture or have the SMB2 dissector enabled in its protocol analysis settings (though SMB2 dissection is typically enabled by default). The attack does not work against Wireshark instances analyzing captures in offline mode through API calls without the dissector engaged. Network-based SMB2 traffic alone (without being captured and processed by Wireshark) poses no risk; the vulnerability only manifests when a human or automated tool uses Wireshark to analyze such traffic.

CVSS 5.5 indicates moderate severity with local attack vector and high availability impact, but real-world risk must account for limiting factors: (1) Attack vector is local (AV:L), not network-remote, significantly reducing attacker reach compared to AV:N vulnerabilities. (2) User interaction required (UI:R) - the victim must actively open a malicious PCAP file or be tricked into analyzing compromised network traffic. (3) No authentication required (PR:N) means any local user can trigger the DoS, but in most environments this is constrained by file access controls. (4) Impact is denial of service only (A:H, C:N, I:N) - no remote code execution, data theft, or system compromise. (5) Scope is unchanged (S:U) - impact is confined to Wireshark process, not the underlying system. The vulnerability is most operationally relevant in SOCs, incident response teams, and security researchers who routinely process untrusted network captures. For end users or organizations that only run Wireshark on trusted packet sources, real-world risk is low. Absence of KEV status and publicly available POC code suggests this has not been weaponized for widespread exploitation, despite being disclosed.

A security analyst receives a malicious PCAP file (via email, malware sandbox download, or threat intel feed) purporting to contain important network evidence. The analyst opens the file in Wireshark on their workstation using vulnerable version 4.6.2. The SMB2 dissector attempts to parse a specially crafted SMB2 packet within the file and enters an infinite loop, causing Wireshark to hang and consume 100% CPU. The analyst's analysis workflow is disrupted, and they must force-kill the process and potentially restart their machine. In a SOC environment, this could disrupt multiple analysts simultaneously if a single malicious PCAP is shared across a team.