Wireshark EUVD-2026-26335

The vulnerability requires opening a malicious packet capture file in Wireshark 4.6.0 through 4.6.4 that contains specifically crafted malformed TLS messages designed to trigger the infinite loop in the dissector. The file must be explicitly opened by a user (AV:L, UI:R from CVSS vector); remote network-based exploitation is not possible. The flaw is triggered during TLS packet parsing, so the capture file must contain TLS protocol traffic or a file format that Wireshark interprets as such. No special configuration or system privileges are required (PR:N), meaning any local user with filesystem access to packet capture files can trigger the condition. The infinite loop affects the Wireshark process scope only (S:U), not system-wide denial of service. Versions 4.6.0 through 4.6.4 are vulnerable; prior and later versions are not affected. Exploitation is limited to users who interact with packet capture files, not passive network listeners using Wireshark in live capture mode.

The CVSS score of 5.5 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a medium-severity local denial of service vulnerability. The local attack vector (AV:L) and requirement for user interaction (UI:R) significantly limit real-world exploitation compared to network-accessible flaws. The low attack complexity (AC:L) indicates minimal technical effort is needed once a victim opens a malicious file. The vulnerability causes availability impact only (A:H) with no confidentiality or integrity compromise. The attack requires a victim to manually open a crafted packet capture file, making this primarily a risk in scenarios involving social engineering or untrusted file sources. While not remotely exploitable over the network, the ease of crafting malicious packets and the widespread use of Wireshark in network analysis workflows means the real-world risk is moderate for security professionals and network analysts who regularly handle packet captures from untrusted sources.

A network administrator or security analyst receives a phishing email with a suspicious packet capture file (.pcap or .pcapng) claiming to contain evidence of malicious network activity. Upon opening the file in Wireshark to investigate, the TLS protocol dissector encounters a malformed TLS record that triggers the infinite loop. Wireshark hangs unresponsively, consuming CPU resources until manually killed, disrupting the analyst's workflow. An attacker could use this to delay incident response or create availability issues in security operations centers that rely on Wireshark for traffic analysis.