Wireshark EUVD-2026-26341

The attacker must deliver a specially crafted packet capture file (PCAP, PCAPNG, or other format supported by Wireshark) containing malformed USB HID packets to a target user. The target user must voluntarily open the file in a vulnerable version of Wireshark (4.6.0-4.6.4 or 4.4.0-4.4.14) running on a local system. The USB HID dissector must be active and configured to process packets in the file - this is the default behavior for Wireshark when USB HID packets are present. No authentication is required, and the attacker does not need privileged access. The attack does NOT require network connectivity; the malicious file can be delivered offline via email, USB, or file sharing. User interaction is mandatory: the user must open the file and allow Wireshark to parse it. The vulnerability does not manifest if the capture file is never opened or if the USB HID dissector is explicitly disabled before opening the file.

CVSS 5.5 with local attack vector (AV:L) and user interaction required (UI:R) reflects moderate real-world risk. The CVSS vector indicates non-privileged local access and low attack complexity, but the requirement for user interaction (opening a crafted file) limits the attack surface. The impact is availability only (A:H) - no confidentiality or integrity compromise. Exploitation requires an attacker to deliver a malicious PCAP or similar capture file to a target user and convince them to open it in Wireshark, making this suitable for spear-phishing or supply-chain scenarios targeting security teams. No EPSS score or KEV status provided in input, but the public issue tracker reference (GitLab) suggests the vulnerability was discovered through coordinated disclosure. The infinite loop denial of service is less severe than remote code execution but still operationally impactful if an analyst's Wireshark instance hangs during incident response. The attack complexity is low because the payload is a file format, not dependent on system state or timing.

A security analyst receives a suspicious PCAP file attached to a phishing email, purportedly containing network evidence of an intrusion. The analyst downloads the file and opens it in Wireshark 4.6.2 to investigate. The file contains a maliciously crafted USB HID packet that triggers an infinite loop in the dissector. Wireshark's UI becomes unresponsive, the process consumes 100% CPU, and the analyst cannot kill the process gracefully, forcing a hard termination. If this occurs during active incident response, it causes operational disruption and delays investigation.