Wireshark CVE-2026-6522

Exploitation requires: (1) Wireshark version 4.6.0-4.6.4 or 4.4.0-4.4.14 running on the target machine, (2) user interaction to open or capture RPKI-Router protocol traffic (not automatic), (3) malformed RPKI-Router packet delivered to the dissector (attacker must control or inject packet content), (4) RPKI-Router dissector enabled in Wireshark (default state). No elevation of privileges required; impact is confined to the Wireshark process. This is NOT a network-remote vulnerability-attacker cannot trigger the hang by sending a packet to Wireshark's listening interface alone; the packet must be captured or read from a file that the user then processes. Local network access or file-based delivery (pcap attachment) is the practical attack vector.

CVSS 5.5 with local attack vector (AV:L) and required user interaction (UI:R) indicates moderate but limited real-world risk. EPSS data not provided in input; without it, CVSS alone suggests this is lower-priority than network-vector vulnerabilities. The denial-of-service impact is high (A:H) but scoped to a single user's Wireshark process-no system-wide impact, no data exfiltration, no privilege escalation. KEV status unknown; if not listed as actively exploited by CISA, this remains a low-urgency patch despite moderate CVSS. Attack complexity is low (AC:L), meaning any malformed RPKI-Router packet triggers the hang. Real-world risk depends on: (1) whether targeted users analyze RPKI-Router traffic in untrusted environments, (2) whether attackers can inject malicious packets into captured traffic streams. For most Wireshark users analyzing standard web/DNS traffic, this vulnerability presents negligible risk. For security researchers, network administrators analyzing BGP security, or users opening untrusted pcap files, it warrants a timely patch.

An attacker crafts a malformed RPKI-Router protocol packet with invalid structure (e.g., truncated length field, malformed state machine trigger) and injects it into network traffic or embeds it in a pcap file. When a Wireshark user opens the pcap or captures the packet live, the RPKI-Router dissector enters an infinite loop during parsing, freezing the Wireshark GUI. The user must force-kill the application, losing any unsaved work. If the malicious pcap is distributed via email or shared repository, multiple analysts may be affected simultaneously.