EUVD-2026-63141
GHSA-9hh6-vc2m-phg6
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Victim must open a crafted ERF file (UI:R, AC:H); impact is limited to crashing the Wireshark process (A:L, S:U) with no confidentiality or integrity consequence.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
AnalysisAI
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively open a specially crafted ERF format capture file within Wireshark - this is a required, explicit user action (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.1 (Low) is well-supported by the full vector: AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malformed ERF capture file and delivers it to a network analyst via email, file share, or a compromised capture repository. When the analyst opens the file in a vulnerable version of Wireshark, the ERF parser performs a buffer over-read and terminates abnormally, disrupting ongoing analysis sessions. … |
| Remediation | Upgrade to Wireshark 4.4.18 or 4.6.8, the first fixed releases in their respective stable branches, as detailed in the vendor advisory at https://www.wireshark.org/security/wnpa-sec-2026-72.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today