Wireshark EUVD-2026-63167

The target must open a specially crafted pcapng file using an affected version of Wireshark (4.6.0-4.6.7 or 4.4.0-4.4.18) on a local system. User interaction is mandatory (UI:R) - the vulnerability cannot be triggered passively or remotely without the user explicitly opening the file within Wireshark. Attack complexity is high (AC:H), indicating specific structural conditions within the pcapng file must be present to trigger the out-of-bounds read; this limits opportunistic exploitation. No authentication or elevated privileges are required to open a capture file. Limiting factors include: the local-only attack surface (AV:L), the requirement for a human to actively open the malicious file, and the high crafting complexity. Passive network traffic capture does not trigger this parser path - only explicit file-open operations against crafted pcapng files are affected.

CVSS base score of 4.7 (Medium) accurately reflects the constrained exploitability profile: AV:L requires local file access, AC:H indicates specific file structure preconditions must be satisfied, UI:R mandates active user interaction, and impact is limited exclusively to availability (A:H) with no confidentiality or integrity effect. The 'Information Disclosure' tag is inconsistent with the CVSS C:N metric - this discrepancy is unresolved by available data and may be a tagging artifact or reflect secondary researcher concern about partial data exposure from the out-of-bounds read prior to crash; this should be verified against the Wireshark advisory wnpa-sec-2026-84. No EPSS data was provided; given no KEV listing and no confirmed POC, automated or widespread exploitation is not a credible near-term scenario. This vulnerability is best prioritized in environments where analysts routinely open untrusted pcapng files from external sources, where the DoS impact could disrupt active incident investigations.

An attacker crafts a malformed pcapng capture file engineered to trigger the out-of-bounds read in Wireshark's parser and distributes it via email attachment, file share, or a deceptive download site targeting network analysts. When a user on an affected Wireshark version (4.6.0-4.6.7 or 4.4.0-4.4.18) opens the file for analysis, the pcapng dissector performs an invalid memory read, crashing Wireshark and potentially disrupting an active forensic or incident-response session. No public exploit code has been identified at time of analysis, meaning exploitation currently requires manual file crafting knowledge.