Wireshark CVE-2026-96422

Exploitation requires a user to open or process an attacker-crafted capture file in a vulnerable Wireshark/tshark build (4.6.0-4.6.8 or 4.4.0-4.4.18), or to capture crafted live traffic that reaches the Frame protocol metadissector. Limiting factors: local attack vector (AV:L) plus required user interaction (UI:R) mean there is no unauthenticated remote trigger - an analyst must actively load the malicious input. Impact is confined to a crash of the analysis tool (A:H only); no data exposure or code execution results.

This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local, user-interaction-dependent denial of service with no confidentiality or integrity impact - the 5.5 (Medium) score is driven entirely by the availability hit (application crash). CWE-617 (Reachable Assertion) confirms this is a controlled abort in Wireshark's 'Frame protocol metadissector' rather than memory corruption or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation. The one signal worth flagging: AV:L combined with UI:R indicates exploitation requires an analyst to open/process an attacker-supplied capture file (or capture malicious live traffic), NOT remote network exploitation - this is the standard Wireshark dissector-crash pattern and should not be read as a remotely-triggerable server flaw. Net: a real but self-limiting bug, low real-world priority despite the ubiquity of the product; patch on normal cadence.

An attacker crafts a malformed capture file (or generates crafted network traffic) that triggers the assertion in Wireshark's Frame metadissector. A network analyst opens the file - or captures the traffic live - and the Wireshark/tshark process crashes, interrupting analysis. No public exploit code has been identified at time of analysis, and the impact is limited to a crash with no code execution.