Wireshark EUVD-2026-42412

Exploitation requires that the vulnerable Wireshark 4.6.0-4.6.6 build actually dissect a crafted TLS packet carrying an Encrypted Client Hello (ECH) extension - the TLS dissector must be enabled (it is by default) and the ECH-bearing traffic must reach the decryptor either via live capture on a monitored link or by opening a malicious capture file. What limits exploitation: the target is a passive analyzer, so the attacker cannot reach it directly over the network - a victim must capture or open the attacker's traffic; impact is confined to a crash (availability only, no code execution or data exposure); and only the 4.6.0 through 4.6.6 versions are vulnerable, so 4.6.7+ and other branches are unaffected. No authentication or explicit user interaction with a dialog is required (PR:N/UI:N), but the operational precondition of capturing/loading the malicious traffic is inherent to how Wireshark is exploited.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity, unauthenticated availability-only impact - the 7.5 is driven entirely by A:H with C:N/I:N. Corroborating signals temper the raw score: EPSS is only 0.14% (4th percentile) and SSVC rates Automatable:no with Technical Impact:partial, indicating this is not a mass-scannable, wormable issue. SSVC does record Exploitation:poc, so working exploit code is understood to exist, but there is no KEV listing and no evidence of active exploitation. The AV:N rating deserves nuance: Wireshark is a passive analyzer, so 'network' exploitation means an attacker must get the victim to capture/open the malicious ECH traffic (live capture on a monitored segment or a shared capture file), not directly connect to a listening service. Net assessment: a genuine but moderate DoS affecting analyst workstations, worth patching promptly but not an emergency for most environments given availability-only impact and low automatability.

An attacker on a network segment being monitored (or who supplies a crafted .pcap to an analyst) sends a malformed TLS handshake containing a specially crafted Encrypted Client Hello extension. When the affected Wireshark 4.6.x build dissects that packet - live or from the saved capture - the ECH decryptor overflows a heap buffer and crashes, interrupting the analyst's session. Public POC code is reported to exist, and the low attack complexity (AC:L) means no special timing or configuration is needed beyond getting the packet processed.