Wireshark CVE-2026-95388

Requires an analyst to load attacker-controlled capture data into the sharkd utility - the JSON-RPC backend used by Wireshark's remote/programmatic analysis features (AV:L, UI:R). Exploitation is limited to environments where sharkd is actually invoked (a narrower deployment mode than the Wireshark GUI/CLI itself), and only against vulnerable builds in the 4.6.0-4.6.8 or 4.4.0-4.4.18 ranges. There is no remote or unauthenticated network path and no privilege escalation; impact is confined to crashing the local analysis process.

This is a genuinely low-priority, high-CVSS-in-name-only issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is availability-only: no confidentiality or integrity impact, local attack vector, and required user interaction. The sole consequence is a crash of the sharkd utility (the JSON-RPC analysis backend that powers Wireshark's remote/programmatic capture-analysis features), which is a recoverable denial of service against an analyst's own tooling, not a server or network service. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence. All signals are consistent - there is no network-vs-local or auth conflict to reconcile - and they collectively point to a low real-world risk. The CWE-122 heap overflow raises a theoretical memory-corruption concern, but the vendor scored it as availability-only (A:H, C:N, I:N), indicating the overflow manifests as a crash rather than exploitable code execution based on available data.

An attacker crafts a malformed capture file or packet stream and induces an analyst to load it into sharkd (e.g., via a Wireshark remote/JSON-RPC analysis workflow), triggering a heap buffer overflow that crashes the utility. This is a local, user-interaction-dependent denial of service against the analyst's own analysis process; no public exploit code is identified at time of analysis.