Wireshark CVE-2026-6524

Exploitation requires (1) the victim to have Wireshark 4.6.0-4.6.4 or 4.4.0-4.4.14 installed, (2) the MySQL dissector to be enabled in Wireshark (enabled by default), (3) a pcap file or live network capture containing the malicious MySQL protocol packet to be opened or processed in Wireshark, and (4) user interaction to open the pcap file or initiate capture (manual file open or automated pipeline reading the file). Remote attackers cannot exploit this without local file access; the local attack vector (AV:L) means the attacker must either be on the same system, have network access to share the file, or socially engineer the user to open it. The crash does not require special Wireshark configuration, only that the MySQL dissector remains enabled in settings. Non-vulnerable configurations include Wireshark 4.6.5+, 4.4.15+, or any version with the MySQL dissector manually disabled. The vulnerability does NOT grant code execution, escalate privileges, or exfiltrate data - impact is strictly denial of service (application crash).

CVSS 5.5 reflects moderate severity: local attack vector (AV:L) requires the victim to be on the same system or network, low complexity (AC:L) means no special conditions beyond crafted input, no privileges required (PR:N), but user interaction (UI:R) is mandatory - the user must open a malicious pcap file or capture to a vulnerable Wireshark instance. The impact is availability only (A:H, no confidentiality or integrity loss). Real-world risk is lower than CVSS suggests because exploitation requires social engineering (sending a pcap file) and user action. The local attack vector means remote exploitation is not possible, limiting scope to analysts and security teams handling untrusted pcap files. Active exploitation has not been confirmed (no KEV listing, no public POC identified), reducing immediate priority relative to network-vector denial-of-service vulnerabilities. However, analysts processing pcaps from compromised networks or honeypots are at genuine risk of application disruption. The vulnerability is real but requires deliberate user interaction and local access context, making it a low-priority remediation for most organizations unless Wireshark is deployed in automated packet processing pipelines where untrusted input is processed without human review.

A security analyst receives a pcap file from a colleague (claiming it contains network evidence from a compromise) or downloads it from a public malware analysis repository. The file contains a specially crafted MySQL protocol packet with an uninitialized pointer dereference in the dissector. The analyst opens the pcap in Wireshark 4.6.2 to examine the traffic; Wireshark begins parsing the MySQL frame, dereferences the invalid pointer, and crashes with a segmentation fault. The analyst loses unsaved work, packet analysis capability is interrupted, and manual restart is required. In a SOAR environment or automated pcap processing system, this crash could silently fail a job, delay incident response, and consume resources attempting retries.