Wireshark sharkd EUVD-2026-26311

Exploitation requires local access to the sharkd daemon (AV:L confirms attack vector is local, not remote). The attacker must send specific crafted input-most likely a malformed packet capture file or network traffic sequence-that triggers the null pointer dereference code path. User interaction is required (UI:R in CVSS vector), indicating the crash is not automatic on daemon startup but depends on the user or automated process feeding crafted data to sharkd. No special privilege elevation is needed (PR:N); any local user or process that can communicate with the sharkd service socket can attempt the exploit. The vulnerability does NOT affect remote network access to sharkd, nor does it require authentication beyond local system access.

CVSS score of 5.5 (Medium) with AV:L/AC:L/PR:N/UI:R/S:U reflects moderate impact: local access, low complexity, no privilege escalation required, but user interaction needed and limited to availability (denial of service only-no confidentiality or integrity breach). The null pointer dereference (CWE-476) is a well-understood and commonly exploitable memory flaw; CVSS AC:L confirms no special exploit complexity. However, real-world risk is constrained by: (1) local-only attack vector-requires presence on the target system, (2) user interaction requirement-the crash must be triggered by a user action, not fully automated, and (3) impact limited to availability-no code execution or privilege escalation. EPSS score, KEV status, and POC availability are not provided in the input; without these, we assess this as a moderate-severity availability issue relevant to security teams managing Wireshark deployments, particularly in environments where sharkd runs as a service accessed by multiple users or processes. The vulnerability is fixable and affects only two narrow version ranges, limiting blast radius. Organizations running current versions of Wireshark are likely unaffected.

An attacker with local access to a system running sharkd sends a malformed packet capture file or crafted API request to the daemon. The null pointer dereference is triggered during processing, causing sharkd to crash and become unavailable for legitimate packet analysis work. If sharkd is running as a service relied upon by network monitoring tools or security appliances, this denial of service disrupts monitoring and alerting.