Wireshark EUVD-2026-26336

Exploitation requires the victim to have Wireshark installed on a local system and to explicitly open a crafted packet capture file containing a malformed iLBC audio frame. The iLBC dissector must be enabled (default configuration). No network exposure or remote triggering is possible - the attack is limited to local file-based delivery. User interaction is mandatory; the vulnerability cannot be triggered remotely or without explicit file opening. Default Wireshark installations are vulnerable; no special dissector configuration changes affect the risk.

Real-world risk is moderate despite the 5.5 CVSS score. The vulnerability requires local file system access and explicit user interaction to open a malicious packet capture file (AV:L/AC:L/UI:R), significantly limiting attack surface compared to network-based vectors. The CVSS vector confirms no authentication bypass or privilege escalation - only denial of service (A:H, C:N, I:N). Without public exploit code confirmation or CISA KEV listing provided, exploitation likelihood remains theoretical rather than immediately critical. However, any user who unknowingly opens a crafted .pcap file from an untrusted source faces service disruption. Organizations relying on Wireshark for critical packet analysis workflows should prioritize patching, but this does not warrant emergency response procedures. The fixed versions indicate the vendor has addressed the root cause.

An attacker crafts a malicious packet capture file containing a specially formatted iLBC audio frame that triggers a heap overflow in the codec dissector. The attacker delivers this file via email or file sharing to a security analyst or network administrator. When the target opens the .pcap file in Wireshark for packet analysis, the dissector parses the malicious iLBC frame, writing beyond heap buffer bounds and causing Wireshark to crash, interrupting the analyst's work.