Wireshark sharkd EUVD-2026-26312

Local access to the system running sharkd is required (AV:L). User interaction is mandatory - the victim must explicitly open or process a crafted PCAP file or malicious network capture (UI:R). The vulnerability does not require elevated privileges (PR:N), meaning any local user can trigger the crash. No authentication to sharkd itself is needed if the user has file system access. Exploitation is limited to local users who can cause sharkd to process the malicious input, not remote network attackers.

CVSS 5.5 with local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but user interaction required (UI:R) indicates moderate but not critical real-world risk. EPSS data not provided, preventing exploitation probability calibration. No KEV status or POC availability confirmed from input data, suggesting this is not yet confirmed as actively exploited in the wild. The heap overflow could theoretically allow code execution depending on heap state and attacker control; however, the CVE description explicitly states only denial of service impact (A:H but C:N I:N), suggesting crashes rather than control flow hijacking. The local-access requirement significantly limits attack surface compared to network-facing vulnerabilities. Risk is elevated on analyst workstations that process untrusted PCAP files but minimal for endpoints not running sharkd.

An attacker crafts a malicious PCAP file or network capture with a specially formatted packet that triggers a heap buffer overflow during parsing. The analyst or automated process opens the file in Wireshark or sharkd, causing the daemon to crash and deny packet analysis services. If the malicious file is delivered via email or shared repository, social engineering or compromised distribution channels could deliver the payload.