Wireshark EUVD-2026-63140

The attacker must deliver a specially crafted Catapult DCT2000 capture file to the victim's local filesystem, and the victim must actively open that file in Wireshark (UI:R). AV:L confirms no direct network-based exploitation path - the file must be present on the local system. AC:H indicates that specific file content conditions must be precisely satisfied to trigger the heap overflow reliably, meaning casual or automated delivery of random malformed files is unlikely to succeed. The attack is limited to those Wireshark installations running versions 4.4.0-4.4.17 or 4.6.0-4.6.7. Authentication requirements are not applicable to the local analyst interaction model; the CVSS PR:N reflects that the attacker needs no special privileges on the victim system to stage the malicious file.

The CVSS 3.1 base score of 4.7 (Medium) accurately reflects the constrained real-world risk profile. AV:L confirms that the attacker cannot reach the target directly over a network - the malicious file must be placed on the analyst's local filesystem and then opened (UI:R). Impact is strictly availability (A:H, C:N, I:N), meaning the worst outcome is a Wireshark crash with no data disclosure or system compromise. AC:H reinforces that triggering the crash reliably requires crafted file content. No EPSS data was provided in the input, so probabilistic exploitation rates cannot be stated. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, both of which further reduce operational urgency. The primary risk is disruption to network analysts or incident responders who are tricked or otherwise exposed to a malformed DCT2000 capture file. This is a real flaw worth patching on schedule, but it does not warrant emergency response.

An attacker crafts a malformed Catapult DCT2000 capture file containing a byte sequence designed to trigger the heap buffer overflow in Wireshark's DCT2000 parser. The file is delivered to a target analyst via email attachment, file share, or a simulated test results bundle. When the analyst opens the file in an unpatched Wireshark instance, the parser overflows the heap buffer, causing an application crash that disrupts the analyst's active capture or analysis session. No public exploit code exists, and the AC:H metric indicates reliable trigger conditions are non-trivial to construct.