EUVD-2026-63163
GHSA-8hhm-54fq-9wrx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
File-triggered parser crash requires user to open a crafted file (UI:R, AC:H); no auth needed; only the local process is affected (A:L, S:U).
Primary rating from Vendor (gitlab).
CVSS VectorVendor: gitlab
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
AnalysisAI
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is running Wireshark version 4.6.0-4.6.7 or 4.4.0-4.4.18, and that the victim explicitly opens or imports a crafted BUSMASTER-format file (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malformed BUSMASTER capture file (.asc or .log) engineered to trigger the reachable assertion in Wireshark's parser, then delivers it to a target analyst - for example, as an email attachment or a shared file in an incident-response context. The analyst opens the file in an affected Wireshark build, causing an immediate abnormal process exit. … |
| Remediation | Upgrade to a Wireshark release beyond the affected version ranges; the vendor advisory at https://www.wireshark.org/security/wnpa-sec-2026-70.html should be consulted for the exact fixed versions, as no specific patch version was included in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today