Wireshark CVE-2026-6521

The vulnerability requires a user to open or process a packet capture containing a specially crafted OpenFlow v5 message in an affected Wireshark version. The attacker must deliver the malicious pcap file to the target via email, file share, web download, or other means, or the target must analyze traffic from an attacker-controlled network segment in real-time capture mode. The OpenFlow v5 dissector must be enabled in Wireshark (default configuration). Versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable; later patch versions are not. The attack is limited by local attack vector, meaning remote network delivery of the packet alone does not trigger the vulnerability-the attacker must trick or socially engineer the user into opening the malicious file or capture in Wireshark.

CVSS 5.5 with local attack vector and user interaction requirement indicates moderate real-world risk. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms this is not remotely exploitable in the traditional sense-an attacker must deliver a malicious packet file or live stream to a target user running Wireshark. The absence of confidentiality or integrity impact limits severity to availability. However, the AC:L (low complexity) and PR:N (no privileges) suggest the attack is trivial to execute once a payload is crafted. The local vector and UI:R (requires user to open/analyze the packet) are significant limiting factors: enterprise blue teams analyzing untrusted pcap files face the highest risk, whereas casual users less likely to receive malicious captures face lower risk. No KEV or public POC was identified, suggesting this is not yet widely exploited in the wild. The straightforward nature of infinite loop bugs means exploitation is probable once technical details are public (post-disclosure), but this is not an active exploitation scenario at analysis time.

A security analyst receives a pcap file from a colleague or external source (e.g., malware sandbox, threat intelligence feed) containing a crafted OpenFlow v5 packet designed to trigger the infinite loop. Upon opening the file in Wireshark, the OpenFlow v5 dissector enters an infinite loop while parsing the malicious packet, causing the application to freeze and consume 100% CPU until force-killed. The attacker's goal is to disrupt the analyst's workflow, delay incident response, or crash systems running Wireshark in batch processing mode (e.g., automated pcap analysis pipelines).