Wireshark EUVD-2026-32629

The victim must have a vulnerable version of Wireshark (4.6.0-4.6.5 or 4.4.0-4.4.15) installed and must manually open a packet capture file containing malformed ROHC protocol data - confirmed by CVSS UI:R (user interaction required). The attack vector is strictly local (CVSS AV:L); there is no network-based or remote exploitation path. The ROHC dissector must be enabled (it is enabled by default in Wireshark installations that support it, but can be disabled as a mitigation). No authentication or elevated privileges are required on the attacker's side (CVSS PR:N), but the attacker must have a delivery mechanism to place the malicious capture file in front of the victim. Exploitation is limited to a process crash only - no code execution, privilege escalation, or data exfiltration is possible based on the C:N/I:N impact vector and the nature of CWE-476.

The CVSS 5.5 (Medium) score accurately reflects a constrained risk profile. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates local-only exploitation requiring user interaction, with no confidentiality or integrity impact - only a high availability impact (process crash). SSVC corroborates this: exploitation status is none, the vulnerability is not automatable, and technical impact is partial. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. Taken together, this is a low-urgency issue: it cannot be triggered remotely without the victim actively opening a malicious capture file, it crashes only the Wireshark GUI process (no persistence or privilege escalation), and there is no evidence of active exploitation. Prioritization should focus on environments where analysts routinely open untrusted or externally sourced capture files.

An attacker crafts a malicious packet capture file (.pcap or .pcapng) containing specially malformed ROHC-compressed header data designed to trigger a null pointer dereference in Wireshark's ROHC dissector. The attacker delivers this file to a network analyst or security researcher - via email attachment, file share, or a compromised traffic feed - and induces the victim to open it in Wireshark. Upon parsing the malformed ROHC data, the dissector dereferences a null pointer, immediately crashing the Wireshark process and disrupting any active analysis session. No public proof-of-concept has been identified at time of analysis.