Wireshark EUVD-2026-26326

The vulnerability requires local file system access to provide a malicious PCAP file to the victim, OR network access to inject malicious iLBC packets into traffic the victim is analyzing with live capture. Crucially, user interaction is mandatory: the victim must open the malicious PCAP file or actively view network traffic containing the crafted iLBC packet in Wireshark. The iLBC dissector must be enabled (default in standard Wireshark installations). The attack cannot be automated or triggered remotely without the analyst's action. Non-affected versions (4.6.5+, 4.4.15+, or versions outside the 4.4.x and 4.6.x branches) are not vulnerable, providing a clear remediation boundary.

The CVSS score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R reflects local attack vector requiring user interaction (opening a file or viewing live traffic containing the malicious packet). The denial-of-service impact (A:H) is confirmed, with no confidentiality or integrity compromise. The local attack vector and requirement for user interaction to view or load a crafted packet significantly limit real-world exploitation compared to network-vector vulnerabilities. However, this is a realistic threat for security analysts, incident responders, or users analyzing untrusted PCAP files in Wireshark. The absence of EPSS data and KEV status in the provided input makes it unclear whether active exploitation is confirmed; the GitLab issue reference suggests this was a reported bug rather than a discovered vulnerability in deployed systems. No workaround is noted, indicating the patch is the primary mitigation path. The use-after-free class (CWE-415) is concerning for potential memory corruption, but the described impact is DoS only.

An attacker crafts a malformed iLBC codec packet and embeds it in a PCAP file or network stream. When a user opens the PCAP file in Wireshark or performs live packet capture and views traffic containing the malicious packet, Wireshark parses the iLBC data, triggers the use-after-free condition, and crashes. No data is exfiltrated or system compromised; the analyst's work is interrupted and the application must be restarted.