Wireshark CVE-2026-6868

CRITICAL: User interaction is required to trigger the vulnerability - the attacker must convince a user to open or analyze a PCAP file, email capture, or network traffic export containing the malformed HTTP packet. The malicious payload must reach the HTTP dissector module, which requires that HTTP traffic be present and the dissector be enabled (default configuration). This is not a network-facing vulnerability; remote attackers cannot directly trigger it over the network. Local access to the system running Wireshark and the ability to supply crafted packet data to the dissector are mandatory prerequisites.

CVSS 5.5 with local attack vector (AV:L), no privileges required (PR:N), but user interaction mandatory (UI:R), limited to availability impact (A:H) with no confidentiality or integrity compromise. The local access requirement and user interaction prerequisite significantly limit real-world exploitation scope compared to network-based attacks. However, the severity depends on deployment context: security analysts, SOC teams, and incident responders regularly open untrusted PCAP files and are therefore at genuine risk. The CVSS score accurately reflects the impact (application unavailability) but the AC:L and PR:N ratings may overstate exploitability since UI:R is the critical gating factor. No KEV status or active exploitation data provided; without EPSS score or public POC confirmation, this appears to be a localized vulnerability affecting specific user roles rather than a widespread critical issue.

A security analyst receives a suspicious PCAP file from a colleague or external source and opens it in Wireshark to investigate network traffic. The file contains a crafted HTTP packet designed to overflow the dissector's stack buffer. Wireshark immediately crashes when attempting to parse the HTTP payload, terminating the analysis session and potentially disrupting the analyst's workflow if used in automated detection systems.