Wireshark EUVD-2026-63174

The victim must be running Wireshark 4.6.0-4.6.7 or 4.4.0-4.4.18 and must actively open a crafted capture file or capture live SSH traffic containing malformed packets - the CVSS AV:L/UI:R metrics confirm both local access and user interaction are mandatory prerequisites. The SSH dissector must be enabled, which is the default Wireshark configuration when SSH traffic is encountered; disabling it removes the attack surface. Limiting factors: remote unauthenticated exploitation is not possible without victim action; impact is strictly a process crash with no privilege escalation, code execution, or data disclosure; only the Wireshark application terminates, leaving the underlying OS and other processes unaffected.

The CVSS 5.5 score with AV:L and UI:R accurately bounds the threat: exploitation cannot occur without the victim actively opening a crafted capture file or capturing malicious live SSH traffic on a local interface. The crash terminates only the Wireshark process with no confidentiality or integrity impact, so the real-world damage is limited to analyst workflow disruption rather than host compromise. EPSS data was not supplied in the available intelligence, and the absence of a KEV listing combined with no known public exploit code supports treating this as a routine patch-cycle item rather than an emergency response. The primary exposure scenario is analyst teams processing untrusted third-party pcap files - environments that share capture files externally should treat the upgrade as higher priority than isolated lab deployments.

An attacker crafts a pcap or pcapng file containing malformed SSH protocol data sized to overflow the heap buffer in Wireshark's SSH dissector. The file is shared with a target analyst via email or a collaborative capture-sharing platform. When the analyst opens the file in an affected Wireshark version, the SSH dissector processes the payload, triggers the overflow, and the Wireshark process crashes. No public exploit code has been identified at time of analysis, but the attack primitive is well understood given the CWE-122 classification and Wireshark's open-source codebase.