Wireshark CVE-2026-5408

User interaction is required: the victim must either open a file containing the malicious BT-DHT packet in Wireshark, or have Wireshark actively capturing live traffic on a network segment where the attacker can inject packets. The attacker and victim must share network access (local network or shared capture interface) to deliver the payload in a live capture scenario. File-based exploitation requires social engineering or file-sharing compromise. Default Wireshark installations with BT-DHT dissector enabled (default behavior) are vulnerable; there is no special configuration required to enable the vulnerable dissector. The attack does NOT require remote network access over the internet-it is strictly local network or file-based. Authentication is not required from the attacker; however, the user opening the file or capturing traffic must have Wireshark installed and running.

CVSS 5.5 with AV:L/AC:L/PR:N/UI:R indicates low-to-moderate real-world risk. The attack vector is LOCAL, not network-based, significantly limiting attack surface in typical deployments-an attacker must have file system access or ability to inject packets on the local network. Attack complexity is low (straightforward packet crafting), no privilege escalation is required, and user interaction (opening a file) is mandatory. The impact is availability-only (crash), with no confidentiality or integrity compromise. Exploitation is NOT remotely triggered over untrusted networks. However, if Wireshark is used in a multi-user environment (shared analysis terminal) or if capturing live traffic from untrusted segments, a malicious peer or network adversary could trigger a denial of service. The CVSS vector does NOT include network access, which contradicts pure "remote" exploitation but aligns with local-network scenarios (e.g., attacker on same WiFi sending crafted BT-DHT packets to the Wireshark host). Real-world risk is moderate: security analysts and NOC staff using Wireshark against untrusted captures face disruption, but widespread remote exploitation is not possible. Patch availability and version specificity (narrow version ranges) further limit exposure.

An attacker crafts a malicious BT-DHT packet containing deeply nested or recursive protocol elements and sends it to a network segment where a security analyst is running Wireshark in live capture mode. When Wireshark processes the packet, the BT-DHT dissector enters uncontrolled recursion, exhausting the stack and crashing the application. Alternatively, an attacker distributes a crafted PCAP capture file via email or web portal; when a user opens it with Wireshark, the crash occurs, interrupting incident response or security analysis.