Wireshark EUVD-2026-26333

Exploitation requires user interaction (UI:R in CVSS vector)-the Wireshark instance must actively parse RTSP traffic, either by opening a PCAP file containing malformed RTSP packets or by live-capturing traffic that includes the malicious payload. The RTSP dissector must be enabled (default state in standard Wireshark builds). Local attack vector means the attacker must have network access to deliver the malformed RTSP packet to a Wireshark session, either via a shared network segment, a file transfer to the analyst, or upstream network compromise. The vulnerability does not allow remote code execution and cannot be exploited without explicit user action to open or process the crafted traffic.

The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates local attack vector with low complexity, no privilege requirement, but requires user interaction (opening a malicious PCAP file or live capture). The impact is limited to availability (crash), with no confidentiality or integrity compromise. The score of 5.5 reflects moderate risk. Exploitation requires user interaction-an analyst must open a file or view live traffic containing the malicious RTSP packet-which reduces real-world attack surface compared to unauthenticated network RCE. However, security researchers, incident responders, and network administrators regularly handle untrusted traffic captures, making this a plausible denial-of-service vector in operational environments. The lack of confirmed active exploitation (no KEV listing, no POC identified) and restriction to a single protocol dissector further limit the immediate threat, but the low complexity and wide user base of Wireshark suggest remediation is warranted.

A security analyst receives a PCAP file from a user claiming to contain evidence of a network breach. Upon opening the file in Wireshark to inspect traffic, the application processes a malformed RTSP packet embedded in the capture, triggering the null pointer dereference in the RTSP dissector. Wireshark crashes, interrupting the incident investigation and forcing the analyst to restart the application and reload the file.