Wireshark CVE-2026-95390

Requires a local user to open a crafted PEAK-System CAN TRC trace file (the automotive CAN-bus capture format) in an affected Wireshark 4.6.0-4.6.8 build; the malformed input triggers the NULL-pointer dereference in the TRC file parser. Exploitation is fundamentally limited by mandatory user interaction (UI:R) and the local attack vector (AV:L) - there is no network-triggerable path - and the impact is confined to a crash of the Wireshark process with no code execution or data exposure.

This is a low-priority, high-prevalence-product availability bug. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a local attacker cannot reach this over a network - exploitation requires a Wireshark user to open a crafted PEAK CAN TRC trace file (UI:R), and the impact is availability-only (a NULL-pointer-dereference crash, CWE-476), with no confidentiality or integrity loss. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so this is 'no public exploit identified at time of analysis.' Although Wireshark is deployed extremely widely among network/security analysts, the real risk is modest: the worst outcome is a single crash of the analysis tool, which recovers on restart. This is a genuine but low-severity issue - not a high-CVSS-but-inflated case (the 5.5 is honest), and not a priority for urgent remediation absent evidence of exploitation.

An attacker crafts a malformed PEAK-System CAN TRC trace capture file and delivers it to an analyst (e.g., as a shared 'sample capture' or incident artifact). When the analyst opens the file in an affected Wireshark 4.6.0-4.6.8 build, the TRC file parser dereferences a NULL pointer and crashes, terminating the session. No public exploit code is identified, and the impact is limited to a recoverable denial of service.