Wireshark EUVD-2026-63141

The victim must actively open a specially crafted ERF format capture file within Wireshark - this is a required, explicit user action (UI:R). The attacker does not control when or whether the file is opened. High attack complexity (AC:H) indicates additional conditions likely apply, such as specific byte sequences or parsing state required to trigger the over-read reliably. Exploitation is strictly bounded to crashing the Wireshark process (A:L); there is no confidentiality or integrity impact, and no scope change affecting the underlying host OS. Versions 4.4.18 and later, and 4.6.8 and later, are not affected. No authentication is required from the attacker (PR:N), but the attack is limited to affecting whoever opens the file.

The CVSS base score of 3.1 (Low) is well-supported by the full vector: AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. The high attack complexity (AC:H) and required user interaction (UI:R) substantially reduce exploitability - an attacker cannot trigger this remotely and autonomously; a target analyst must be induced to open a malicious ERF file. The availability impact is scoped to the Wireshark process alone (A:L, S:U), not system-wide disruption. No EPSS score was supplied, no CISA KEV listing exists, and no POC has been identified, all of which are consistent with a low-priority finding. In practical terms, even a small IT security operations team would not be expected to treat this as urgent compared to higher-severity, weaponized vulnerabilities; it belongs in a normal patch cycle. The primary realistic threat is targeted disruption of a network analyst's session, not infrastructure compromise.

An attacker crafts a malformed ERF capture file and delivers it to a network analyst via email, file share, or a compromised capture repository. When the analyst opens the file in a vulnerable version of Wireshark, the ERF parser performs a buffer over-read and terminates abnormally, disrupting ongoing analysis sessions. No public POC or exploit code has been identified at time of analysis.