Wireshark EUVD-2026-42418

Exploitation requires a user running Wireshark 4.6.0 through 4.6.6 to actively open a specially crafted pcapng capture file - user interaction is mandatory (UI:R in the CVSS vector). The attack complexity is rated High (AC:H), meaning the malicious pcapng file must be specifically structured to trigger the heap overflow, which is not trivially achieved with arbitrary malformed input. No authentication, elevated privileges, or special Wireshark configuration is required; the standard pcapng file parsing capability is enabled by default. Limiting factors include: the attacker must successfully deliver the file to the target (social engineering dependency), the target must actively open the file in Wireshark rather than another tool, and the precise file structure required by AC:H raises the bar compared to a simple crash-on-open scenario. The vulnerability cannot be triggered remotely without victim interaction, and there is no network-facing exploitation path. Exploitation impact is strictly local to the Wireshark process - no privilege escalation or lateral movement is implied by the available data.

The CVSS 3.1 base score of 4.7 (Medium) accurately reflects a constrained attack surface: local vector, high complexity, mandatory user interaction, and impact limited exclusively to availability. No EPSS score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, providing no signal of confirmed active exploitation. POC availability is unknown from the provided sources. The practical real-world risk is moderate: the attacker must socially engineer a Wireshark user into opening a malicious pcapng file, and the primary user base of security analysts and network engineers may exercise elevated caution with untrusted capture files. The combination of AC:H and UI:R meaningfully limits opportunistic or automated exploitation. The absence of confidentiality or integrity impact further constrains business risk to service disruption of the analysis tool only - not data exfiltration or system compromise. This is a real but low-priority patching target for most organizations unless Wireshark is used in automated or scripted capture analysis pipelines where untrusted files may be processed without human review.

An attacker crafts a malformed pcapng capture file engineered to trigger a heap buffer overflow in Wireshark's parser and delivers it to a network analyst via phishing email, shared file repository, or by injecting it into a network capture stream the analyst is likely to review. When the analyst opens the file in an affected Wireshark version (4.6.0-4.6.6), the parser overflows the heap buffer, crashing the application and denying service of the analysis session. No public exploit code has been identified at time of analysis, and successful exploitation requires precise file crafting consistent with the AC:H rating.