EUVD-2026-63144
GHSA-744r-mg5c-qh5x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Network vector as crafted traffic or files reach the dissector; AC:H for required payload precision; UI:R mandatory as victim must actively open or capture; availability-only crash impact confirmed.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
AnalysisAI
Wireshark's RDP protocol dissector in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing specially crafted RDP packet data, resulting in denial of service. Exploitation requires user interaction - a victim must open a malicious capture file or actively dissect attacker-controlled RDP traffic - and attack complexity is rated high, reflecting the need for a precisely crafted payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Wireshark 4.4.0-4.4.17 or 4.6.0-4.6.7 with the RDP dissector enabled (enabled by default) and to actively open a crafted capture file or capture live network traffic containing attacker-controlled RDP packets. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.1 (Low) accurately characterises the constrained real-world impact: the vulnerability causes only a crash of the Wireshark application (A:L) with no confidentiality or integrity consequence (C:N/I:N), and requires both high attack complexity (AC:H) and active user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious .pcapng file containing specially malformed RDP packets designed to trigger the heap overflow in Wireshark's RDP dissector, then shares it with a network analyst - for example, as a purported incident evidence file or threat intelligence sample. The analyst opens the file in a vulnerable Wireshark version, causing an immediate application crash. … |
| Remediation | The primary fix is to upgrade to Wireshark 4.4.18 or 4.6.8, as confirmed by EUVD-2026-63144 and detailed in the Wireshark Foundation advisory at https://www.wireshark.org/security/wnpa-sec-2026-67.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today