Wireshark EUVD-2026-26328

Requires that a vulnerable Wireshark instance (4.4.0-4.4.14 or 4.6.0-4.6.4) actually dissect attacker-controlled OpenFlow v6 protocol data - either by live-capturing crafted OpenFlow v6 traffic on a monitored segment or by opening a capture file containing such packets. Limiting factors: impact is confined to a denial of service (process hang/crash) with no data exposure or code execution (C:N/I:N); exploitation presupposes someone is running Wireshark and parsing the malicious OpenFlow v6 traffic, so this affects analyst/monitoring workstations rather than production services; and non-affected branches or patched builds (4.4.15 / 4.6.5 and later) are not vulnerable.

Signals are consistent and point to a genuine but low-urgency availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates it High purely on availability impact - there is no confidentiality or integrity effect, and the only consequence is a crash/hang of the Wireshark process via an infinite loop (CWE-835) in the OpenFlow v6 dissector. EPSS is 0.01% (2nd percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing - all of which agree this is not under active exploitation and is unlikely to be mass-exploited. The vuln.today 'this_week' priority reflects that a vendor patch exists and should be applied on a normal cadence, not that it is an emergency. One nuance worth verifying: the vendor CVSS marks UI:N, but Wireshark is an analyst-operated packet dissector and exploitation in practice typically requires the tool to either live-capture crafted OpenFlow v6 traffic or open a malicious capture file; the exact trigger is not described in the available sources. Net: a real priority to patch, but a low real-world risk - a tool-crash DoS, not a server-compromise vector.

An attacker crafts malformed OpenFlow v6 packets and either injects them onto a network segment being live-captured by a Wireshark 4.4.0-4.4.14 or 4.6.0-4.6.4 instance, or supplies a capture file containing them to an analyst. When the OpenFlow v6 dissector parses the crafted data it enters an infinite loop, hanging or crashing Wireshark and denying analysis. No public exploit identified at time of analysis; the specific malformation that triggers the loop is not described in the available sources.