Wireshark EUVD-2026-88705

Exploitation requires a local user to open an attacker-crafted capture file or feed malformed CSN.1-encoded packet data into a vulnerable Wireshark instance (versions 4.6.0-4.6.8 or 4.4.0-4.4.18); the CSN.1 dissector must process the crafted input. Limiting factors are significant: the CVSS vector specifies a local attack vector (AV:L), mandatory user interaction (UI:R), and HIGH attack complexity (AC:H), meaning the overflow does not trigger deterministically and there is no remote or automated path. No authentication is modeled (PR:N), but the human-in-the-loop file-open requirement and the recoverable crash-only outcome sharply constrain real-world impact.

This is a low-priority, availability-only denial-of-service issue despite the CWE-122 (heap buffer overflow) classification. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) yields 4.7 (Medium) and is internally consistent: it is a LOCAL vector requiring user interaction (opening a crafted capture file or loading malformed CSN.1-encoded traffic into Wireshark), with HIGH attack complexity and no confidentiality or integrity impact - only a crash. Notably, this CVE carries AC:H, making it harder to trigger reliably than most of its sibling Wireshark dissector CVEs (which are AC:L). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept identified in the provided data. Although the heap-overflow CWE could in theory suggest memory-corruption/code-execution potential, the vendor scoring explicitly sets C:N/I:N and models only a crash (A:H), so this should be treated as a DoS, not an RCE. Real-world risk is low: an attacker cannot reach this remotely or without a human analyst opening attacker-supplied data, and the outcome is a recoverable application crash.

An attacker crafts a malicious capture file (or malformed CSN.1-encoded packets) and induces a network analyst to open it in a vulnerable Wireshark build. When the CSN.1 dissector processes the crafted data, a heap buffer overflow crashes the application, denying the analyst use of the tool. No public exploit code is identified at time of analysis, and the HIGH attack complexity means the crash may not trigger reliably.