Wireshark CVE-2026-95395

Exploitation requires a local victim to open an attacker-supplied packet capture (or otherwise process attacker-controlled traffic) that contains malformed IEEE C37.118 Synchrophasor protocol frames, so the C37.118 dissector code path must actually run - meaning the capture must include synchrophasor/PMU traffic. Limiting factors: attack vector is local (AV:L), user interaction is mandatory (UI:R, the analyst must load the file), and impact is confined to availability (application crash via memory leak) on affected Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 - there is no confidentiality or integrity impact and no code execution.

This is a genuinely low-priority issue despite a moderate 5.5 CVSS. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H is availability-only (C:N/I:N/A:H) and, critically, local (AV:L) with required user interaction (UI:R): a user must open a crafted capture file or load a trace containing malicious IEEE C37.118 Synchrophasor packets. CWE-401 (memory leak) yields a resource-exhaustion/OOM condition rather than memory corruption or code execution - the 'DoS' impact is a recoverable crash of an analyst's client tool, not a service outage. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or probable exploitation; SSVC would land at exploitation=none, automatable=no (requires human to open a file), technical impact=partial. There is no conflict among the signals here - every source points to a client-side, low-consequence bug. The only nuance is that the vulnerable dissector is the C37.118 synchrophasor protocol used in electric-grid/PMU monitoring, so real-world triggering requires an analyst to be examining that specific traffic type, narrowing exposure further.

An attacker crafts a packet capture (or injects malformed IEEE C37.118 synchrophasor frames onto a monitored segment) and induces a Wireshark analyst to open the resulting capture file. Parsing the frames causes the C37.118 dissector to leak memory repeatedly, exhausting RAM and crashing the analyst's Wireshark instance. No public exploit code is identified at time of analysis, and exploitation is limited to a local, user-initiated crash with no code execution or data disclosure.