Wireshark EUVD-2026-26322

Exploitation requires that the Monero protocol dissector be enabled in Wireshark (enabled by default) and that a user manually open a malformed pcap file containing a crafted Monero protocol packet, or that live packet capture receive a malicious Monero packet from the network. The attacker cannot force the application to parse the packet remotely; user action (opening a file or initiating capture) is mandatory. The vulnerability is not exploitable via remote unauthenticated network access alone; it is limited to local scenarios where the attacker can supply a malicious pcap file or has network-level access to inject a crafted packet during an active capture session initiated by the target user.

CVSS 5.5 with vector AV:L/AC:L/PR:N/UI:R indicates local attack vector requiring user interaction, low attack complexity, and no privilege escalation needed-consistent with a file-opening vulnerability. The uncontrolled recursion (CWE-674) is a well-understood class capable of immediate DoS. Attack complexity is low because no special configuration is required; the vulnerable dissector is enabled by default in standard Wireshark installations. The impact is availability-only (A:H, C:N, I:N), confirming denial of service without data compromise. Exploitation requires user interaction (UI:R), which moderately constrains real-world impact compared to network-vector exploits. EPSS score not provided; however, the combination of low complexity, no privileges required, and user interaction aligns with moderate exploitation likelihood. KEV and POC status unknown from provided data. Real-world priority depends on whether Monero traffic is prevalent in the organization's network analysis workflows; for organizations using Wireshark passively against general traffic, risk is lower; for those actively monitoring blockchain networks, risk is higher.

An attacker crafts a pcap file or generates a Monero protocol packet containing deeply nested or recursively malformed protocol structures. When a network analyst or security engineer opens the malicious pcap file in Wireshark or when the tool receives the crafted packet during live network capture, the Monero dissector attempts to parse the malformed data, triggering unbounded recursion that consumes stack memory and crashes the application. The analyst is left without packet analysis capability until Wireshark is restarted.