Wireshark EUVD-2026-63138

Exploitation requires that the target has an affected version of Wireshark (4.6.0-4.6.7 or 4.4.0-4.4.17) installed and locally accessible. The attack vector is local (AV:L): the attacker cannot reach Wireshark over the network directly; instead, the user must either open a crafted capture file containing malicious CMS protocol data or capture live traffic on a network where an attacker can inject such packets. High attack complexity (AC:H) means the crafted input must precisely trigger the null dereference condition. The CMS dissector must be enabled (it is enabled by default, so no non-default configuration is required for this specific condition). Exploitation is limited to crashing the Wireshark process - no code execution or data exfiltration is possible via this vulnerability.

The CVSS 3.1 base score of 4.7 (Medium) reflects the constrained attack surface: AV:L requires the attack to occur locally on the analyst's machine, AC:H indicates exploitation is not trivially reproducible, and UI:R means user interaction - such as opening a crafted pcap file or initiating a capture on a network carrying malicious CMS traffic - is required. Impact is limited to availability (A:H), with no confidentiality or integrity exposure. No EPSS data was provided, and this CVE is not listed in the CISA KEV catalog, nor is any POC publicly available at time of analysis. Taken together, real-world risk is low-to-moderate: the vulnerability is meaningful for analysts who routinely open untrusted capture files, but is not remotely exploitable in a default network-facing sense and is unlikely to be mass-exploited. The primary realistic threat actor is an adversary who can convince a security analyst to open a crafted capture file as part of an investigation.

An attacker crafts a malicious pcap or pcapng file containing a malformed CMS protocol message designed to trigger a null pointer dereference in Wireshark's CMS dissector. The attacker delivers the file to a security analyst - for example, by embedding it in a phishing email disguised as a suspicious capture to investigate - and the analyst opens the file in an affected Wireshark version, causing the application to crash. No public exploit code has been identified at time of analysis.