Wireshark CVE-2026-6536

The vulnerability requires that a user with local system access deliberately opens a malformed DLMS/COSEM packet capture file in Wireshark. The crafted capture must contain a DLMS/COSEM packet with a structure that triggers the infinite loop condition in the dissector's parsing logic - this is the specific technical prerequisite embedded in the packet data itself. No special Wireshark configuration or feature flags are needed; default installation is vulnerable. The attack is limited to denial of service (freezing the application); it does not lead to code execution, data corruption, or system compromise. Exploitation requires user interaction (UI:R in CVSS vector) - the attacker cannot remotely trigger this over the network but must convince or trick a user into opening the file locally.

CVSS 5.5 with local attack vector (AV:L) and user interaction required (UI:R) indicates moderate but not critical risk. The availability impact is high (A:H), confirming denial of service as the primary impact. However, the local attack vector significantly constrains real-world exploitation - the attacker must have local file system access or convince a user to open a malicious capture file. The CVSS vector shows no confidentiality or integrity impact (C:N/I:N), limiting the attack to resource exhaustion. No KEV status, EPSS score, or POC confirmation provided in input data, but the GitLab issue reference suggests this is a known, reported issue rather than a zero-day. The attack complexity is low (AC:L) and no privileges are required (PR:N), meaning any local user can trigger it. Risk is primarily to analysts and security teams who process untrusted packet captures or to users who download malicious .pcap files from the internet.

A security analyst receives a packet capture file from a suspicious email or untrusted source, claiming to contain network diagnostics for troubleshooting. The analyst opens the file in Wireshark 4.6.2 to inspect it. When Wireshark's DLMS/COSEM dissector begins parsing a specially crafted DLMS/COSEM packet in the capture, the dissector enters an infinite loop, consuming CPU and freezing the application. The analyst must force-kill the process and restart, disrupting their workflow.