Wireshark CVE-2026-6519

Exploitation requires a vulnerable Wireshark/TShark build (4.4.0-4.4.14 or 4.6.0-4.6.4) to dissect a crafted MBIM (Mobile Broadband Interface Model) protocol frame - reached either by capturing attacker-injected traffic on a monitored interface or by opening a malicious capture file. Limiting factors: impact is confined to a hang/denial of service of the Wireshark process only (no code execution, no confidentiality or integrity impact per C:N/I:N); SSVC marks it non-automatable, so it is not mass-exploitable; and the attacker must get the target to actually dissect MBIM data, which in file-based workflows effectively depends on analyst interaction even though the published vector is UI:N. Fixed in 4.4.15 and 4.6.5; the vendor advisory indicates upgrading is the remediation.

Signals are consistent and point to a genuine but bounded availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a network-reachable, low-complexity, unauthenticated denial of service with no confidentiality or integrity impact - an infinite loop (CWE-835) in the MBIM dissector. The SSVC framework agrees on direction but tempers urgency: Exploitation is rated 'poc' (not active), Automatable is 'no' (an attacker cannot trivially mass-exploit - each hit requires the target to dissect the crafted MBIM traffic), and Technical Impact is 'partial' (it hangs the Wireshark/TShark process rather than compromising the host). EPSS is 0.01% (2nd percentile), which is very low and consistent with a non-wormable analyst-tool DoS, and there is no CISA KEV listing. The vuln.today decision label is 'this_week' - a routine patch cadence, not an emergency. The one point worth verifying: Wireshark advisories conventionally score dissector flaws as AV:N/UI:N on the premise that an attacker injects crafted packets onto a monitored link, but in many real deployments the trigger is an analyst opening a malicious capture file (effectively requiring user interaction) - the available sources do not state the exact delivery path. Net: a real 'patch on the normal cycle' item, not a drop-everything priority; the high A:H score reflects severity of the hang, not broad real-world exploitability.

An attacker injects a crafted MBIM (Mobile Broadband Interface Model) protocol frame onto a network segment that a victim is capturing, or supplies a malicious capture file that an analyst opens in a vulnerable Wireshark/TShark build. When the MBIM dissector parses the frame it enters an infinite loop (CWE-835), hanging the application and denying further analysis. A public PoC reference exists (SSVC Exploitation: poc); it is not verified as working exploit code.