Wireshark CVE-2026-6870

Exploitation requires local system access (AV:L) and user interaction (UI:R). The specific condition is that the victim must open a crafted PCAP file or packet capture containing a malformed GSM RP protocol frame in the Wireshark GUI on a vulnerable version (4.6.0-4.6.4 or 4.4.0-4.4.14). No authentication is required (PR:N), and the dissector triggers automatically upon file load without additional user action beyond opening the file. The attack does not depend on Wireshark being configured in a non-default mode; any standard installation with GSM RP dissector enabled is vulnerable. Attack limitations include: file must reach the victim machine, victim must choose to open it in Wireshark (social engineering or physical access required), and impact is localized to the Wireshark process on that single machine.

CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack surface, low exploitation complexity, no authentication required, but mandatory user interaction (opening a file). The EPSS score of 5.5 maps to moderate likelihood of exploitation in the wild, consistent with a local DoS requiring social engineering (trick user to open malicious PCAP/packet file). The absence of KEV status and no public POC identified at analysis time suggests this is not yet widely targeted. However, risk is non-negligible in environments where Wireshark operators receive untrusted packet captures (e.g., security researchers, network forensics teams, SOC analysts). Unlike remote code execution, impact is limited to availability-application crash with no data exfiltration. The uninitialized pointer (CWE-824) is a memory safety issue that could escalate to code execution if the pointer happens to reference writable memory, but CVSS restricts impact to Availability:High. The UI:R requirement (user must interact) significantly reduces real-world exploitation likelihood compared to remotely triggerable dissector flaws.

A malicious actor crafts a GSM RP protocol packet with an uninitialized pointer dereference condition embedded in the frame structure. They distribute the packet as part of a PCAP file or via email, framed as a network traffic sample for analysis. When a Wireshark user opens the file in the GUI to inspect traffic, the GSM RP dissector processes the malicious packet, attempts to dereference the corrupted pointer, and crashes the application. The operator's current packet capture session and any unsaved analysis data is lost, disrupting incident response or forensic investigation workflow.