Wireshark CVE-2026-6525

User must open or load a pcap file (or capture live traffic) containing a malformed IEEE 802.11 frame in Wireshark 4.6.0-4.6.4. The IEEE 802.11 dissector must be active (default configuration). Exploitation requires the attacker to either place a malicious pcap file accessible to the local user or inject a crafted 802.11 frame into a live capture. Network-based exploitation is not possible; remote attackers cannot trigger the crash directly. The crash is deterministic when a malformed frame is processed, but the attacker must engineer the specific frame structure that bypasses frame validation and causes null pointer dereference - exploitation is not trivial and requires knowledge of the dissector's parsing logic.

CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with low complexity and required user interaction - the attacker must either be present on the local system or deliver a malformed pcap file that a user opens. CVSS score of 5.5 reflects availability impact only (no confidentiality or integrity compromise). The null pointer dereference is a deterministic crash condition rather than exploitable for code execution. Real-world risk depends on deployment context: security analysts repeatedly opening untrusted pcap files or network monitoring systems auto-processing traffic from untrusted sources face higher risk. The low CVSS score appropriately reflects that this is a denial-of-service-only vulnerability with moderate impact (application crash, not data loss or system compromise). No EPSS, KEV status, or POC data provided; exploitation likelihood appears lower than the CVSS alone suggests due to local-only attack vector and user-interaction requirement.

A security analyst receives a pcap file from an external source or downloads a sample from a threat intelligence platform. When opening the file in Wireshark 4.6.x to inspect network traffic, the dissector parses a malformed 802.11 frame, triggers the null pointer dereference, and crashes the application. The analyst loses unsaved analysis and must restart Wireshark.