Wireshark EUVD-2026-63173

Exploitation requires that the target be running Wireshark with an active capture session on an interface that can receive the attacker's crafted ESS packets - either on the same broadcast domain, via a span/mirror port feed, or by opening an attacker-supplied pcap file containing malformed ESS frames. The ESS dissector must be enabled (it is on by default in standard Wireshark installations). Limiting factors: Wireshark is a human-initiated desktop tool, not a persistent service, so the exploitation window exists only during active capture sessions; SSVC Automatable:no confirms mass scanning-style exploitation is not feasible. Authentication to the target host is not required (CVSS PR:N), but the attacker must be able to place packets into the capture stream, which constrains the attack to local-network or man-in-the-middle positions.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects that the crash is network-reachable and requires no authentication, but materially overstates operational risk for most deployments. Wireshark is a user-run desktop analysis tool, not a persistent network daemon; exploitation windows are bounded by active capture sessions initiated by a human operator. SSVC corroborates this: Automatable:no and Technical Impact:partial, with Exploitation:none. EPSS at 0.25% (16th percentile) aligns with SSVC - mass exploitation is not feasible. The practical victim population is limited to security analysts and network engineers capturing traffic on hostile or adversary-controlled segments. Impact is availability-only (crash, no data exfiltration or integrity violation). Real-world priority should be lower than CVSS alone implies; patch during the next maintenance cycle unless analysts routinely capture on untrusted segments.

An attacker positioned on a network segment being actively captured by a Wireshark instance crafts a malformed ESS protocol packet and transmits it so that Wireshark ingests it during dissection. The ESS dissector reads an uninitialized variable while parsing the packet, triggering an unhandled crash that terminates the capture session. No public proof-of-concept has been identified, but the low-complexity CVSS vector (AC:L) suggests the triggering condition involves a straightforward malformed field rather than a complex heap-grooming sequence.