Wireshark CVE-2026-6530

Exploitation requires the victim to open a crafted packet file or live-capture DCP-ETSI traffic using Wireshark 4.6.0-4.6.4 or 4.4.0-4.4.14. The DCP-ETSI dissector must be enabled (default configuration). The malformed packet must contain specific invalid field lengths or truncated payloads that trigger the heap overflow during dissection. Remote network-based exploitation is NOT possible because Wireshark runs locally and does not expose the dissector to unauthenticated network input; exploitation is constrained to local file access or local network sniffing by the user running Wireshark.

CVSS 5.5 reflects a local attack vector with low complexity and no privileges required, but the impact is availability only (denial of service). The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly identifies that exploitation requires local file access and user interaction (UI:R), limiting real-world scope. This is not a remote code execution or privilege escalation risk. Risk is MODERATE for environments where Wireshark processes untrusted capture files or live feeds in multi-user settings; LOW for isolated packet analysis workstations. The requirement for user interaction (opening a crafted file) and local access significantly reduces exploit probability compared to the raw CVSS score. No EPSS score, POC status, or KEV listing provided; treat as non-actively-exploited at time of analysis.

An attacker crafts a malformed network packet or packet capture (PCAP) file with invalid DCP-ETSI headers and truncated payload fields. A security analyst or network administrator opens this file in Wireshark 4.6.0-4.6.4 or 4.4.0-4.4.14 to investigate traffic. The DCP-ETSI dissector processes the malformed data, writes beyond heap buffer bounds, and crashes Wireshark, interrupting the analysis workflow. The attacker's goal is operational disruption, not data theft or system compromise.