Wireshark CVE-2026-6537

The vulnerability requires user interaction (UI:R in CVSS vector): a user must actively open a malicious ZigBee packet capture file in Wireshark. The attacker cannot trigger the crash remotely over a network or via unauthenticated access to the system. The vulnerable code path is only executed when Wireshark processes ZigBee protocol frames, so the crafted packet capture must contain valid ZigBee frame structures that trigger the specific buffer overflow condition in the dissector. Default configurations of Wireshark include ZigBee dissector support, so no unusual configuration is required. The vulnerability does not require elevated privileges (PR:N), meaning any local user with the ability to run Wireshark can be targeted. The attack is limited by the requirement to socially engineer the user and the need for the PCAP file to contain precisely crafted ZigBee data; generic or unrelated packet captures will not trigger the vulnerability.

The CVSS score of 5.5 reflects moderate risk with a local attack vector (AV:L), low complexity (AC:L), and no privileges required (PR:N), but critically requires user interaction (UI:R). The impact is limited to availability (A:H), with no confidentiality or integrity impact, meaning an attacker cannot read data or modify files-only crash the application. The EPSS score is not provided, limiting quantification of real-world exploitation likelihood. No KEV listing or confirmed public exploit code is mentioned, suggesting this is not currently being weaponized at scale. The practical threat is narrow: an attacker must socially engineer a user to open a malicious PCAP file or crafted packet capture in Wireshark. However, the requirement for user interaction significantly reduces risk compared to a network-based remote code execution vulnerability. Defense-in-depth strategies (network segmentation, endpoint detection) are less relevant here; the primary mitigation is straightforward: update to patched versions. The stack overflow condition could theoretically be escalated to code execution in certain scenarios (stack layout, ASLR bypass), but no evidence of such exploitation exists in the provided data.

An attacker crafts a malicious ZigBee packet capture file (PCAP) and sends it via email or hosts it on a website, claiming it contains interesting network traffic or a debugging example. A user downloads and opens the file in Wireshark for analysis. Upon parsing the ZigBee frames, the dissector's buffer overflow is triggered, causing Wireshark to crash and preventing the user from completing their analysis-a simple denial of service attack requiring no technical sophistication beyond packet crafting.