Wireshark CVE-2026-6531

Exploitation requires user interaction: the attacker must convince a user running vulnerable Wireshark (4.6.0-4.6.4 or 4.4.0-4.4.14) to open a file containing SANE protocol packets, or expose Wireshark to a live capture containing such packets. The SANE dissector must be active (default configuration enables dissectors for all recognized protocols unless explicitly disabled). No network connectivity or elevated privileges are required. The attack is limited to local systems where Wireshark is installed; remote attackers cannot trigger it without social engineering or network access to inject SANE traffic into a monitored network segment.

CVSS 5.5 with local attack vector and user interaction requirement limits real-world impact compared to network-based remote code execution vulnerabilities. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U) indicates a local attacker must convince a user to open a malicious pcap file or be on the same local network segment analyzing live traffic. Attack complexity is low once user interaction occurs, and impact is availability only (no confidentiality or integrity compromise). KEV status not provided in input; POC appears documented in the GitLab issue. The denial of service is temporary (process hang) and recoverable by force-killing Wireshark, making this a low-impact disruption for most security operations. However, in environments where Wireshark runs unattended for packet analysis pipelines or automated threat hunting, the hang could delay detection workflows.

A security analyst receives a suspicious pcap file from a colleague or external source for investigation. The file contains crafted SANE protocol packets designed to trigger the dissector's infinite loop. Upon opening the file in Wireshark 4.6.2, the application freezes and becomes unresponsive as the SANE dissector enters an infinite loop parsing the malformed packet. The analyst must force-kill the process, losing any unsaved analysis work and delaying incident response workflow.