Wireshark CVE-2026-95386

Exploitation requires the victim to manually open a crafted capture file in the TTL trace-file format (a CAN-bus/Tektronix-family capture format) using Wireshark 4.6.0 through 4.6.8; the malicious input triggers an infinite loop in the TTL file parser. Limiting factors are significant: the attack vector is local (AV:L), it requires user interaction (UI:R - the analyst must open the attacker-supplied file), no authentication is bypassed, and impact is confined to availability of the local Wireshark process (a hang) with no confidentiality or integrity effect. Versions outside 4.6.0-4.6.8, and workflows that never open untrusted TTL captures, are not exposed.

This is a low-priority availability-only issue despite the moderate 5.5 CVSS base score. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms local attack vector with required user interaction (a victim must open a crafted TTL capture file) and impacts only availability - no confidentiality or integrity loss, and the impact is a recoverable hang/crash of the analysis process rather than code execution. There is no EPSS score, no CISA KEV listing, and no public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis.' The CWE-835 infinite loop is a classic parser resource-exhaustion bug. All signals are internally consistent: an attacker cannot reach this remotely or without tricking a user, and the payoff is merely a denial of service of the analyst's own Wireshark instance. This is a genuine but low-severity bug, not a widespread exploitation threat.

An attacker crafts a malformed TTL-format capture file and sends it to a network analyst (e.g., as a 'sample capture' to investigate), who opens it in Wireshark 4.6.0-4.6.8. The TTL file parser enters an infinite loop and hangs the application, denying the analyst use of the tool until the process is killed. No public exploit code is known, and exploitation is limited to the local user who opens the file.