Wireshark EUVD-2026-26334

The vulnerability requires a user to open a capture file (pcap, pcapng, or other format supported by Wireshark) or enable live packet capture on an interface that receives the malformed ASN.1 PER packets. The specific condition is interaction with Wireshark's ASN.1 PER dissector module-if the user is analyzing traffic that includes ASN.1 PER-encoded protocols (e.g., certain telecom or industrial protocols) and the dissector is enabled (default), the crash triggers upon packet processing. No authentication or elevated privileges are required to open a file in Wireshark. Limitations: exploitation is strictly local (not remote over network), requires user action to load the malicious payload, and impacts only the Wireshark process itself (no privilege escalation, no system compromise).

This is a LOW-to-MODERATE real-world risk despite the 5.5 CVSS score. The attack vector is local (AV:L) with low complexity (AC:L) and no privileges required (PR:N), meaning an attacker cannot exploit this remotely over a network. User interaction (UI:R) is mandatory-a victim must deliberately open a malicious .pcap file, receive it via email, or Wireshark must auto-open a live capture containing the payload. The impact is denial of service only (availability hit, A:H; no confidentiality or integrity compromise, C:N/I:N), and no KEV listing or public POC has been identified. The low EPSS score and lack of active exploitation signals suggest this affects users who intentionally work with untrusted packet captures-a narrower threat surface than, for example, network-adjacent RCE. Security teams managing Wireshark deployments for network analysis should prioritize patching, but this is not a critical incident-response priority for most organizations.

An attacker crafts a malformed .pcap file containing specially constructed ASN.1 PER packets with nested, recursive structures that exceed the dissector's call stack depth. The attacker sends the file to a network analyst or security researcher via email or uploads it to a shared analysis platform. When the victim opens the file in Wireshark to examine the traffic, the dissector enters unbounded recursion, the application crashes, and any unsaved analysis is lost. No code execution or data exfiltration occurs, but the analyst's workflow is disrupted.