Wireshark CVE-2026-96417

Requires the victim to open a crafted capture file (or process a live capture) containing malformed RF4CE protocol packets in an affected Wireshark version (4.6.0-4.6.8 or 4.4.0-4.4.18). Exploitation is limited by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the analyst must actively load the malicious input - and the RF4CE dissector must be reached, which happens when RF4CE-classified traffic is present. Impact is confined to a crash of the Wireshark process; there is no authentication requirement (PR:N) but also no network-remote trigger and no confidentiality/integrity impact.

This is a genuine but low-priority issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is availability-only with a LOCAL attack vector requiring user interaction - consistent with the description's 'denial of service' outcome and inconsistent with any remote or code-execution threat. Despite the 'Buffer Overflow'/'Heap Overflow' (CWE-122) tags, the vector explicitly rates C:N and I:N, meaning the heap corruption manifests only as a crash, not memory disclosure or exploitation for code execution. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here - every source (CVSS, description, CWE-to-impact mapping, absence of KEV/EPSS/POC) points the same direction: a locally-triggered, recoverable dissector crash. The one caveat is that a heap overflow is theoretically more dangerous than an infinite-loop DoS, but the vendor-scored impact caps this at availability, so treat it as low real-world risk despite the alarming overflow tags.

An attacker crafts a malicious packet capture (or a live RF4CE frame) containing malformed RF4CE protocol data and induces an analyst to open it in a vulnerable Wireshark build. When the RF4CE dissector parses the crafted data it triggers a heap overflow that crashes the application, interrupting the analyst's work. No public proof-of-concept is referenced, and exploitation yields only a crash - no code execution or data disclosure.