Wireshark CVE-2026-6538

The BEEP dissector must be enabled (default configuration in Wireshark). Exploitation requires either (1) a user with local system access running Wireshark and opening a malicious .pcap or .pcapng file, or (2) Wireshark capturing live network traffic containing the crafted BEEP packet on the same local network segment where the user is analyzing traffic. The attacker cannot exploit this remotely over a network-the local access vector and user interaction requirement (UI:R) mean the user must explicitly open a suspicious file or be passively capturing traffic on a monitored network. Non-default dissector configurations or filtering rules that exclude BEEP traffic prevent exploitation.

CVSS 5.5 with local attack vector and user interaction requirement significantly lowers real-world risk compared to network-vector vulnerabilities. EPSS data not provided, but the attack surface is limited: exploitation requires either (1) a user running Wireshark locally and opening a malicious packet capture file, or (2) live network traffic capture of crafted BEEP packets on the same system. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms local-only access, no special privileges, and mandatory user interaction-these constraints substantially reduce priority compared to remote vectors. Denial of service impact is moderate; Wireshark crash does not affect other system functions or enable privilege escalation. Organizations using Wireshark in isolated analysis environments face lower risk than those relying on it for continuous production traffic analysis. KEV status unknown-no confirmation of active exploitation provided.

An attacker crafts a BEEP protocol packet with a malformed frame structure (e.g., oversized payload header or invalid offset) and delivers it either as an attachment in a packet capture file sent to a Wireshark user, or via live network traffic on a monitored segment. When the user opens the file in Wireshark or the application processes the live traffic, the BEEP dissector parses the malformed packet, writes beyond the allocated stack buffer, and causes Wireshark to crash, disrupting the user's traffic analysis workflow.