Wireshark CVE-2026-5654

Exploitation requires a vulnerable Wireshark build (4.6.0-4.6.4 or 4.4.0-4.4.14) to actually dissect AMR-NB codec data - the AMR-NB dissector must process the crafted payload, meaning the user must be capturing or opening traffic that contains AMR-NB frames (typically RTP voice payloads). The practical limiting factor is that an attacker must either inject crafted AMR-NB packets onto a network the victim is live-capturing or deliver a malicious capture file for the victim to open; the supplied vector claims no user interaction, but file-based delivery would require the analyst to open the capture. The specific overflow trigger within the AMR-NB dissector is not described in the available sources. Impact is confined to a crash of the Wireshark process (DoS); no code execution, data disclosure, or integrity impact is indicated.

This is a moderate-priority availability issue, not a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure denial-of-service: no confidentiality or integrity impact, only a crash of the Wireshark AMR-NB dissector. The high base score is driven entirely by the availability metric and the network vector; it should not be read as remote code execution despite the CWE-121 (stack-based buffer overflow) classification, because the only stated outcome is a crash. Corroborating signals point to low real-world urgency: EPSS is 0.01% (2nd percentile), the CVE is NOT on CISA KEV, and SSVC rates Automatable as 'no' with only 'partial' technical impact. SSVC does record Exploitation as 'poc,' so a proof-of-concept is believed to exist, but POC availability is not active exploitation. The vuln.today decision label is 'this_week,' consistent with a patch-available DoS in a widely used tool rather than an act-now scenario. One caveat worth verifying: the CVSS vector asserts UI:N and AV:N, but Wireshark dissector crashes are frequently triggered by a human opening a crafted capture file, which would be UI:R - the AV:N/UI:N scoring holds only if the attacker can inject crafted AMR-NB packets into traffic that a victim is live-capturing. Verify the trigger mode with the Wireshark advisory (wnpa-sec-2026-18).

An attacker crafts malformed AMR-NB (Adaptive Multi-Rate narrowband) codec data and gets it into traffic that an analyst is examining with a vulnerable Wireshark build - either by injecting packets onto a network segment being live-captured or by supplying a malicious capture file. When Wireshark's AMR-NB dissector parses the crafted payload, a stack buffer overflow crashes the application, interrupting the analysis session. A proof-of-concept is indicated by SSVC (Exploitation: poc) via the public GitLab issue, but no verified working exploit is confirmed in the input, and the impact is limited to a crash.