Wireshark EUVD-2026-88704

Requires a victim running Wireshark 4.6.0-4.6.8 or 4.4.0-4.4.18 to manually open a maliciously crafted Microsoft Network Monitor (netmon) capture file; there is no remote or network-triggered path. Exploitation is strictly limited by mandatory user interaction (UI:R - the analyst must open the file), local attack vector (AV:L), and high attack complexity (AC:H) tied to constructing input that triggers the unbounded parser loop. Impact is confined to a recoverable denial of service (crash/hang) of the local application - no confidentiality or integrity effect.

This is a low-priority availability issue despite the 'Microsoft' branding in the name. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, score 4.7) describes a purely local, user-interaction-dependent, availability-only crash - not a remote or code-execution flaw. The affected product is actually Wireshark (CPE cpe:2.3:a:wireshark_foundation:wireshark), and 'Microsoft Network Monitor' refers to the netmon capture-FILE format that Wireshark parses, not to a Microsoft product; the 'Microsoft' tag is therefore a vendor mislabel. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' The high attack complexity (AC:H, reflecting the crafted-file 'large loop' condition) plus mandatory user interaction (analyst must open the malicious capture) make real-world weaponization unattractive: the payoff is only a recoverable crash/hang of the analyst's own client. This is a routine hygiene fix, not an emergency - a low-real-risk issue whose CVSS is already modest.

An attacker crafts a malformed Microsoft Network Monitor (netmon) capture file and delivers it to a security analyst (e.g., as a 'sample to analyze' via email or a shared incident bundle). When the analyst opens the file in Wireshark, the file parser enters an unbounded/excessive loop (CWE-606) and the application hangs or crashes. No public exploit code has been identified, and impact is limited to denial of service on the analyst's workstation.