Wireshark EUVD-2026-26316

The AFP Spotlight protocol dissector must be enabled in Wireshark (default configuration). A malformed AFP Spotlight packet or pcap file containing such a packet must reach the dissector; this can occur via opening a malicious pcap file locally or receiving the packet during live network capture if the attacker shares network access with the victim. User interaction is required-either explicitly opening a file or initiating a capture session. Exploitation does not require authentication, elevated privileges, or a remote network connection to Wireshark itself; however, the attacker must be able to deliver the packet either as a file or over the network segment where the victim is capturing traffic. Default Wireshark installations with no custom dissector filtering are vulnerable.

CVSS 5.5 reflects a medium-severity denial of service with important mitigating factors: local or adjacent attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) to open a file or trigger packet capture. The vulnerability does not lead to code execution, data exfiltration, or integrity compromise-only availability impact (A:H). Exploitation requires an attacker to deliver a malicious pcap file or inject a crafted packet into the victim's network segment, both of which demand active attacker presence or social engineering. Real-world risk is moderate for users who handle untrusted capture files or operate on networks with active adversaries. Network analysts and incident responders who frequently open external pcap files face higher risk. The local attack vector and user interaction requirement significantly reduce exposure compared to network-vector denial-of-service threats. No EPSS score, POC status, or KEV listing provided; exploitation likelihood is plausible but not confirmed as active or weaponized.

A security analyst receives a pcap file from an external source purporting to contain network samples for incident analysis. When the analyst opens the file in Wireshark 4.6.3, the AFP Spotlight dissector immediately encounters a malformed packet that triggers infinite recursion, causing Wireshark to crash and forcing the analyst to restart the application. Alternatively, an attacker on a shared network sends a crafted AFP Spotlight packet during the analyst's live packet capture session, inducing the same crash and interrupting their investigation.