Wireshark EUVD-2026-63177

Exploitation requires the target to be running a vulnerable version of Wireshark (4.4.0-4.4.18 or 4.6.0-4.6.7) with the C12.22 protocol dissector active - either performing a live packet capture on a network that carries C12.22/AMI traffic, or opening a crafted PCAP file containing malformed C12.22 packets. The C12.22 dissector must be enabled in Wireshark's protocol list (verify default state from vendor advisory). The CVSS PR:N and UI:N ratings indicate that, for the live-capture vector, no authentication and no additional user interaction beyond the existing capture session are required - the attacker need only inject a malformed packet into the captured traffic stream. Limiting factors: the attacker must either (a) be positioned to inject packets onto the network interface Wireshark is capturing, or (b) social-engineer the analyst into opening a malicious PCAP file; C12.22 is a niche AMI protocol not present in most enterprise environments, significantly constraining the realistic attack population.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and reflects unauthenticated, low-complexity network exploitation with no user interaction, but with impact strictly limited to availability. The underlying CWE-121 (stack-based buffer overflow) is a class that can sometimes enable code execution, but the vendor advisory and CVSS impact metrics limit the confirmed impact to a crash (DoS); no code execution has been asserted. No EPSS score was included in available data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC exist, indicating no known widespread active exploitation. Real-world risk is bounded by the attack surface: Wireshark is primarily a desktop analyst tool rather than an always-on network service, and C12.22 is a niche AMI protocol, meaning the window for unauthenticated exploitation requires either control over captured traffic or ability to deliver a malicious PCAP. For security operations teams or ICS/utility analysts running Wireshark on live AMI feeds, the risk is concrete and should be patched promptly. For general enterprise environments without AMI infrastructure, practical risk is low despite the high CVSS score.

An attacker with access to a network segment being captured by a Wireshark analyst - such as an internal adversary on an AMI network, or a network-adjacent attacker during a packet capture session - transmits a specially crafted C12.22 protocol packet. The malformed packet is processed by the vulnerable C12.22 dissector, triggering the stack-based buffer overflow and immediately crashing Wireshark, denying the analyst network visibility. Alternatively, the attacker could deliver a malicious PCAP file containing the crafted C12.22 traffic and persuade the analyst to open it. No public POC has been identified at time of analysis.