Wireshark CVE-2026-96418

Exploitation requires a user to open or process a crafted capture containing malicious TIFF data in Wireshark 4.6.0-4.6.8 or 4.4.0-4.4.18 (UI:R). It is local/client-side (AV:L) - there is no remote unauthenticated path; the analyst must load the attacker-supplied file or dissect attacker-controlled traffic. Impact is limited to a recoverable application hang (availability only); no data disclosure, modification, or code execution results. This limits realistic risk to targeted social-engineering of analysts rather than mass exploitation.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 (Medium) and correctly captures a local, availability-only impact: no confidentiality or integrity loss, only a hang. Despite PR:N (no privileges), the AV:L and UI:R metrics mean this is NOT remotely exploitable - an analyst must actively open a crafted capture file or process malicious TIFF-carrying traffic in Wireshark. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so no signal suggests active or automatable exploitation. CWE-835 (infinite loop / unreachable exit condition) produces a recoverable denial of service - the analyst kills and restarts the process - rather than memory corruption or code execution. All available signals are consistent: modest CVSS, availability-only, local vector, no exploitation evidence. This is a routine dissector-hardening fix, not a priority patch.

An attacker crafts a malformed TIFF stream inside a packet capture (or on a monitored network segment) and induces a network analyst to open or dissect it in a vulnerable Wireshark build. The TIFF dissector enters an infinite loop, hanging the application until it is force-killed. No public exploit code has been identified, and exploitation requires the victim to load the crafted data (UI:R).