Wireshark EUVD-2026-26319

Exploitation requires a user to open a malformed FC-SWILS protocol capture file in Wireshark using an affected version (4.4.0-4.4.14 or 4.6.0-4.6.4). The specific malformed packet structure is not detailed in available references, but the vulnerability is triggered during dissector parsing of Fibre Channel Switch InterLink Service frames. No special Wireshark configuration is needed - the dissector runs by default on FC protocol traffic. Exploitation is limited by the requirement that a user must manually open the file (no automatic or passive attack vector exists) and only affects systems running affected Wireshark versions. Systems running Wireshark 4.2.x, earlier 4.4 versions (before 4.4.0), or later patched releases are not vulnerable.

CVSS 5.5 (Medium) reflects a local attack vector with user interaction, high availability impact, and no confidentiality or integrity loss. EPSS score not provided. The vulnerability does NOT appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been identified. Real-world risk is moderate but context-dependent: security analysts, network engineers, and incident responders who regularly open untrusted capture files face higher risk than typical end users. The local attack vector and UI requirement significantly limit attack surface compared to network-based remote code execution vulnerabilities. This is a legitimate priority for organizations exchanging packet captures (e.g., in incident response, threat intelligence sharing, or SAN monitoring), but not a critical business risk for most environments. Verify with Wireshark Foundation whether versions beyond 4.6.4 and 4.4.14 remain affected, as no explicit EOL or fixed versions are stated in provided references.

A network administrator receives a malicious packet capture file (.pcap) in an email or through a threat intelligence sharing platform, ostensibly containing network forensics data. When the administrator opens the file in Wireshark to investigate, the FC-SWILS dissector parses a crafted Fibre Channel frame, triggering uncontrolled recursion that crashes Wireshark and disrupts the analyst's work. This scenario is plausible in incident response and SAN monitoring contexts.