Wireshark CVE-2026-7375

Exploitation requires a vulnerable Wireshark instance (4.4.0-4.4.14 or 4.6.0-4.6.4) to dissect crafted UDS (Unified Diagnostic Services, an automotive diagnostic protocol) traffic - the UDS dissector must actually process the malformed packet, either from live capture or from an opened capture file. Limiting factors: impact is confined to availability (application hang/DoS) with no confidentiality or integrity effect; the target must be running an affected version with the UDS dissector engaged; and reachability in practice depends on getting the crafted UDS frames in front of the analyst's capture, which narrows exposure compared to a server-side listener. The CVSS lists UI:N, but a dissector is only triggered when Wireshark processes the traffic, so an analyst action (starting a capture or opening a file) may be required - not confirmed by the sources.

This is a moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity, unauthenticated condition with high availability impact and no confidentiality or integrity impact - consistent with an infinite loop (CWE-835) that hangs the dissector. However, the real-world signals temper this: EPSS is only 0.01% (2nd percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', indicating patch within the normal cycle rather than act_now/emergency. The one point of friction worth verifying: the CVSS marks UI:N, but a packet dissector is only reachable when Wireshark actually processes the malicious UDS traffic (live capture or opening a capture file) - if exploitation depends on an analyst loading a capture, effective exploitation requires user interaction, which further lowers practical risk. Net: a genuine DoS bug in an analyst tool, worth patching on a normal schedule, not a widespread-exploitation crisis.

An attacker crafts malformed UDS (Unified Diagnostic Services) protocol frames and gets them into traffic that a Wireshark analyst captures live or opens from a supplied capture file. When Wireshark's UDS dissector parses the crafted packet, it enters an infinite loop (CWE-835), hanging or consuming CPU and denying use of the analysis tool. No public exploit code is identified in the available data, and impact is limited to availability of the Wireshark instance.