Wireshark CVE-2026-5655

Exploitation requires local file access and user interaction to open a malicious packet capture or SDP stream in Wireshark. The attacker cannot remotely trigger the crash over the network; the victim must explicitly open the crafted file or stream. No authentication is required once local access is obtained. The vulnerability is specific to Wireshark versions 4.6.0 through 4.6.4 and only manifests when the SDP protocol dissector processes the specially-crafted malicious SDP message. The use-after-free condition depends on the specific sequence of SDP message parsing and memory cleanup operations; not all malformed SDP input will trigger it, only crafted payloads that replicate the exact memory state conditions.

CVSS 5.5 with local attack vector (AV:L) and requirement for user interaction (UI:R) indicates moderate real-world risk. The local-only attack vector significantly constrains exploitation compared to network-accessible vulnerabilities. The use-after-free weakness (CWE-416) is a serious memory corruption class that could theoretically enable code execution, but the CVSS vector limits impact to availability (A:H, confidentiality and integrity unaffected), suggesting the vulnerability as discovered manifests primarily as denial of service rather than privilege escalation or code execution. User interaction is required, meaning a victim must open a malicious packet capture or SDP stream in Wireshark. No EPSS score or KEV listing available in provided data to assess exploitation likelihood or active abuse. The confined scope (S:U, same-user) and local access requirement lower practical risk for network-facing deployments, but pose moderate risk in environments where untrusted PCAP files or SDP streams are analyzed by privileged analysts or within secure network analysis workflows.

An attacker crafts a malicious SDP protocol message or packet capture file containing a specially-formed SDP session description that triggers the use-after-free condition in Wireshark's dissector. The attacker sends this file to a network analyst or places it in a shared repository. When the victim opens the file in Wireshark (requiring user interaction), the SDP dissector processes the malicious message, dereferences freed memory, and crashes the application, causing denial of service.