Wireshark CVE-2026-6532

Exploitation requires the Kismet protocol dissector to be active and processing Kismet traffic or a crafted Kismet packet within a capture file. The user must explicitly open a malicious packet capture file in Wireshark, or Wireshark must be in live-capture mode on a network where an attacker can inject Kismet frames (practical only on local networks or wireless LANs where the attacker has network presence). Default Wireshark installations have the Kismet dissector enabled, so no special configuration is required; however, networks that do not use Kismet sensors are unlikely to encounter this packet type in normal operations. The impact is localized to the Wireshark process and does not extend to the operating system, network, or other applications.

CVSS 5.5 with AV:L/AC:L/PR:N/UI:R/S:U indicates moderate impact: local attack vector (file-based, not network), low complexity, no privileges required, but requires user interaction (opening a file) and causes only availability impact (no confidentiality or integrity breach). The EPSS score, exploitation difficulty metrics, and lack of CISA KEV status suggest this is a low-priority real-world threat despite the CVSS rating. The attack requires a user to explicitly open a malicious capture file or have Wireshark in live-capture mode processing attacker-controlled traffic-both are scenarios with limited attack surface outside controlled network analysis environments. The impact is localized denial of service (crash) without code execution or data exfiltration. This vulnerability is primarily a stability/reliability issue rather than a critical security boundary breach.

An attacker crafts a malformed network packet (or packet capture file) with an invalid Kismet protocol structure designed to trigger a buffer over-read. The attacker distributes this file via email or embeds it in a web page. A network analyst or security researcher downloads the file and opens it in Wireshark for inspection. The Kismet dissector processes the malformed packet, reads beyond buffer boundaries, and causes Wireshark to crash, denying access to the analysis tool and potentially losing unsaved work.