Wireshark EUVD-2026-26323

Exploitation requires a local user to open a malicious packet capture file (pcap, pcapng, or similar format) containing a crafted DCP-ETSI packet in Wireshark. The dissector must be enabled and active during packet rendering or analysis. Default Wireshark configurations include the DCP-ETSI dissector, so no special non-default configuration is required. The attack does NOT work remotely over the network - an attacker cannot trigger the crash by transmitting packets on the wire. A user must explicitly load the malicious file into Wireshark's interface, making social engineering or file-sharing mechanisms the necessary attack vector. The vulnerability does not require elevated privileges or authentication beyond the ability to provide a file to the target user.

CVSS 5.5 (medium) reflects local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but user interaction mandatory (UI:R), with high availability impact (A:H) but no confidentiality or integrity impact. EPSS and KEV status are not provided in the input data, so active exploitation cannot be confirmed. The requirement for user interaction and local file access substantially reduces real-world risk: an attacker must convince a user to open a malicious capture file, which is a social engineering dependency. This is a true denial-of-service (crash) rather than code execution, meaning the impact is application availability only. Risk priority depends on deployment context: security analysts regularly processing untrusted pcap files face higher risk than typical end-users. The buffer overflow class (CWE-122) suggests potential for exploitation beyond DoS in theory, but CVSS correctly limits the impact to availability, indicating the practical exploitation path is restricted to crashing the dissector.

A network security analyst receives a pcap file allegedly containing DCP-ETSI protocol traffic from a colleague or external source. When the analyst opens the file in Wireshark to inspect the packets, the malformed DCP-ETSI packet triggers a heap buffer overflow in the dissector, causing Wireshark to crash. The analyst loses unsaved analysis work and must manually restart the application to resume their investigation.