Wireshark
Monthly
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Denial of service in Wireshark's UMTS FP protocol dissector affects the 4.6.0-4.6.6 and 4.4.0-4.4.16 release branches, where a malformed UMTS Frame Protocol packet triggers a heap-based buffer overflow (CWE-122) that crashes the application. A remote attacker who can get the crafted frame parsed - via live capture on a monitored segment or a shared capture file - can reliably terminate the analyzer, with no confidentiality or integrity impact. Publicly available exploit code exists (SSVC=poc) but it is not on CISA KEV, and EPSS is low at 0.14% (4th percentile), indicating minimal observed exploitation pressure.
Denial of service in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 lets a remote attacker crash or hang the application by feeding it crafted packets that trigger infinite loops in multiple protocol dissectors. No public exploit is identified at time of analysis, and the flaw is limited to availability - no code execution or data exposure. Real-world urgency is modest: EPSS sits at 0.12% and CISA SSVC rates exploitation as 'none' with only partial technical impact.
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.9%.
Pcapng file parser crash in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18 enables denial of service via a locally-opened malformed capture file. Rooted in CWE-125 (Out-of-Bounds Read), the parser reads beyond an allocated buffer boundary when processing certain pcapng structures, causing application termination. No public exploit identified at time of analysis and not listed in CISA KEV; real-world risk is constrained by the local attack vector and required user interaction.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Wireshark's BLF file parser affects versions 4.6.0-4.6.6 and 4.4.0-4.4.16, stemming from use of an uninitialized variable (CWE-457) that may expose portions of process memory when parsing a crafted BLF file. Exploitation is constrained by a local attack vector, high attack complexity, and mandatory user interaction - a victim must actively open a malicious file. With a CVSS score of 2.5, no CISA KEV listing, and no public exploit identified at time of analysis, this is a low-priority finding with a narrow, socially-engineered attack surface.
Denial of service in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 is caused by a heap-based buffer overflow in the Catapult DCT2000 protocol dissector, crashing the application when a crafted capture file is opened. The CVSS local attack vector (AV:L) and required user interaction (UI:R) constrain exploitation to scenarios where an analyst is socially engineered into opening a malicious capture file - no remote or unauthenticated network exploitation path exists. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released fixes are available in 4.6.7 and 4.4.17.
The pcapng file parser in Wireshark 4.6.0 through 4.6.6 contains a heap-based buffer overflow (CWE-122) that crashes the application, resulting in denial of service. An attacker must convince a user to open a specially crafted pcapng capture file, making this a social-engineering-dependent attack with no network-facing exploitation path. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor patch is available in Wireshark 4.6.7.
The FMP/NOTIFY protocol dissector in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 crashes when processing malformed packet data, resulting in a denial of service against the application. Exploitation requires a victim to open a crafted packet capture file or analyze injected traffic, making this a social-engineering-dependent vector rather than a remotely triggerable flaw. A vendor-released patch is available in versions 4.6.7 and 4.4.17; no public exploit or CISA KEV listing has been identified at time of analysis.
Wireshark's SSH protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.4.0-4.4.16 and 4.6.0-4.6.6, enabling denial of service against any analyst or engineer running an affected build. The flaw is triggered locally when Wireshark processes malformed SSH protocol data, whether from a live capture or a crafted packet capture file, causing the application to crash and disrupting network analysis workflows. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Wireshark's Z39.50 protocol dissector crashes the application when processing malformed Z39.50 PDUs, resulting in denial of service. Affected versions span the 4.4.x branch (4.4.0-4.4.16) and 4.6.x branch (4.6.0-4.6.6). An attacker can trigger the crash by persuading an analyst to open a crafted packet capture file or by injecting malicious Z39.50 traffic onto a monitored network segment; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Denial of service in Wireshark's DBS Etherwatch dissector affects release branches 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, where a malformed capture file or crafted packet can crash the application. The flaw is a stack-based buffer overflow (CWE-121) that manifests only as an availability impact - no confidentiality or integrity loss and no confirmed code execution - carrying a 7.5 (High) CVSS. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stack-based buffer overflow in Wireshark's IEEE 802.11 (Wi-Fi) protocol dissector crashes the application, resulting in denial of service across versions 4.6.0-4.6.6 and 4.4.0-4.4.16. An attacker with the ability to deliver a malicious packet capture file, or inject crafted 802.11 frames into a live capture session, can crash the Wireshark process on a victim analyst's machine. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches (4.6.7 and 4.4.17) are available.
Denial of service in Wireshark 4.6.0 through 4.6.6 lets a remote attacker crash the application by feeding it a malformed TLS packet using the Encrypted Client Hello (ECH) extension, triggering a heap buffer overflow in the ECH decryptor. No authentication or user interaction beyond processing the traffic is required, though impact is limited to availability (analyzer crash) with no code execution or data disclosure claimed. Publicly available exploit code exists per SSVC (POC), EPSS is low at 0.14% (4th percentile), and it is not listed in CISA KEV.
Denial of service in Wireshark's ciscodump remote capture utility (extcap) affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, where a heap-based buffer overflow (CWE-122) can crash the capture tool. An attacker able to feed crafted data to a running ciscodump session can terminate the process, disrupting live packet capture. A POC is referenced by CISA's SSVC assessment (no public exploit code independently identified), it is not in CISA KEV, and EPSS is very low at 0.10% (1st percentile), indicating minimal likelihood of widespread exploitation.
Null pointer dereference in Wireshark's ROHC protocol dissector causes application crashes across two active release branches, constituting a denial-of-service condition. Affected versions span Wireshark 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15; patched releases 4.6.6 and 4.4.16 are available per the vendor advisory wnpa-sec-2026-51. The attack vector is local with required user interaction (CVSS AV:L/UI:R), meaning exploitation requires a victim to open a specially crafted packet capture file - no remote or automated exploitation path exists, and no public exploit code or active exploitation has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.4 crashes when processing malformed IEEE 802.11 frames due to a null pointer dereference in the protocol dissector. An attacker can trigger denial of service by crafting or replaying a specially malformed wireless packet that causes the dissector to crash when analyzed, rendering packet analysis impossible until the application restarts. CVSS score 5.5 reflects local attack vector with user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by parsing malformed K12 RF5 files with user interaction. The vulnerability stems from a buffer overflow in the K12 RF5 file parser, requiring an attacker to trick a user into opening a crafted file. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed Monero protocol packets causes application crash through unbounded recursion in the protocol dissector. Local attackers with user-level privileges can trigger the crash by opening a crafted pcap file or receiving a malicious network packet during live capture, requiring user interaction to open the malicious file but resulting in complete unavailability of the packet analysis tool.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed BT-DHT protocol packets, enabling local denial of service against users who open crafted capture files or sniff untrusted network traffic. The vulnerability requires local access and user interaction (opening a file or viewing live capture), but no authentication is required. EPSS exploitation probability is moderate given the low attack complexity and the prevalence of Wireshark in security operations.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed FC-SWILS (Fibre Channel Switch InterLink Service) protocol packets, enabling denial of service via local or remote delivery of a crafted packet file. The vulnerability requires user interaction (opening a malicious capture file), and no active exploitation has been confirmed at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in SMB2 protocol dissector allows local attackers to crash the application when processing malicious or malformed SMB2 network traffic. Exploitation requires user interaction (opening a crafted capture file or live capture), and causes high availability impact with no data confidentiality or integrity compromise. CVSS 5.5 reflects local attack vector but potential for widespread impact given Wireshark's role in network analysis workflows.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed ICMPv6 PvD (Prefix Validation Data) packets crashes the protocol dissector, requiring user interaction to open a crafted capture file. The vulnerability affects local users only (AV:L) and does not enable code execution, information disclosure, or integrity compromise.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed AFP Spotlight protocol packets, causing denial of service. An attacker can trigger the crash by delivering a crafted packet to a user running a vulnerable version, disrupting packet analysis and network monitoring. The vulnerability requires local or direct network access and user interaction to open a malicious capture file or receive the packet during live capture, but no authentication is needed.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via stack buffer overflow in the AMR-NB codec decoder allows local attackers with user interaction to crash the application. The vulnerability requires opening a specially crafted network capture file, making it exploitable in scenarios where users are tricked into opening untrusted PCAP files or when Wireshark auto-opens recent captures.
Denial of service in Wireshark 4.6.0 through 4.6.4 via crafted SDP protocol packets allows local attackers with user interaction to crash the application through a use-after-free memory corruption vulnerability in the SDP protocol dissector. EPSS and KEV status not available at analysis time; no public exploit code identified.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via crafted iLBC codec packets allows local attackers with user interaction to crash the application and interrupt service. The vulnerability stems from a use-after-free condition in the iLBC codec parser, triggered when Wireshark processes malformed audio codec data, causing an application crash without code execution.
Heap buffer overflow in the DCP-ETSI protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when a user opens a malicious packet capture file. The vulnerability requires user interaction (opening a crafted .pcap or similar file locally) and crashes the application, preventing further packet analysis. No public exploit code or active exploitation has been confirmed at this time.
Stack buffer overflow in Wireshark's BEEP protocol dissector causes denial of service when processing malformed network packets. Versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable; a local user with the ability to interact with Wireshark or supply crafted BEEP traffic can trigger a crash via a specially crafted packet that requires user interaction to open or process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in Wireshark's ZigBee protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash and denial of service when processing malformed ZigBee packets. An attacker must trick a user into opening a crafted packet capture file or visiting a malicious webpage serving the packet, since the vulnerability requires local file access and user interaction. No active exploitation has been publicly reported.
Wireshark versions 4.6.0 through 4.6.4 contain an infinite loop vulnerability in the DLMS/COSEM protocol dissector that causes denial of service when processing malformed packets. A local attacker with user privileges can trigger the infinite loop by opening a crafted DLMS/COSEM packet capture file, freezing the application and rendering it unresponsive without requiring authentication or special configuration.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes application crash during zlib decompression in the packet dissection engine when processing malformed compressed traffic. Local attackers with user privileges can trigger the crash by opening a specially crafted pcap file or receiving a malicious packet capture, requiring user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the USB HID protocol dissector allows local attackers to crash the application by opening a maliciously crafted packet capture file. The vulnerability requires user interaction (opening a file) on a local system, making it suitable for targeted attacks against security analysts and network administrators who routinely inspect suspicious network traffic.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by triggering an unhandled exception in the LZ77 decompression engine when processing malformed compressed packet data. The vulnerability requires user interaction (opening a crafted packet capture file or receiving a malicious packet) but causes immediate application termination, impacting network analysis workflows.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed Kismet protocol packets due to a buffer overflow in the Kismet dissector, allowing unauthenticated remote denial of service via a crafted network capture file or live traffic. User interaction (opening a malicious capture file or capturing traffic) is required. No public exploit code or active exploitation has been identified at the time of analysis.
Infinite loop in the SANE protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed SANE packets. A local attacker with user privileges can trigger the infinite loop by crafting a specially formatted SANE network capture or injecting malicious packets, causing Wireshark to hang and become unresponsive, denying analysts access to packet analysis.
Heap buffer overflow in Wireshark's DCP-ETSI protocol dissector causes denial of service when processing malformed network packets in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local user can trigger a crash by opening a crafted packet file or live network capture, rendering the packet analysis tool unresponsive. No remote exploitation or data exfiltration is possible; impact is limited to availability.
Heap buffer overflow in the iLBC audio codec dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger a denial of service crash by supplying a malformed iLBC packet. The vulnerability requires user interaction to open a crafted packet capture file and does not enable code execution.
Infinite loop in the TLS protocol dissector of Wireshark 4.6.0 through 4.6.4 causes denial of service when processing malformed TLS packets. Local attackers can trigger the infinite loop by crafting packets and opening them with Wireshark, causing the application to hang or consume excessive CPU resources. User interaction is required to open the malicious packet capture, limiting the attack to scenarios where a victim is tricked into opening untrusted network traffic files.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed ASN.1 PER protocol packets, enabling local denial of service against users opening crafted capture files. The vulnerability requires user interaction (opening a file or receiving a live packet capture) but allows an attacker to hang or crash the application without authentication. No active exploitation has been confirmed in public sources.
Denial of service in Wireshark 4.6.0 through 4.6.4 via null pointer dereference in the RTSP protocol dissector causes application crash when processing malformed RTSP traffic. Local attackers with network access to a Wireshark instance can trigger the crash by supplying a specially crafted RTSP packet, resulting in availability impact. No public exploit code or active in-the-wild exploitation has been identified; patch availability status requires verification from vendor.
Denial of service via MySQL protocol dissector crash in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local users with no privileges to crash the application through a crafted malicious pcap file or network capture, requiring only user interaction to open the file. The vulnerability stems from improper memory access in the MySQL dissector parser (CWE-824: Access of Uninitialized Pointer), resulting in application termination and loss of packet analysis capability. No public exploit code or active exploitation has been identified at time of analysis.
Infinite loop in the GNW protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user interaction can craft malicious GNW traffic or files to exhaust CPU resources and freeze the application, preventing legitimate packet analysis and potentially disrupting network troubleshooting workflows.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable to denial of service via infinite loops in the OpenFlow v5 protocol dissector when processing maliciously crafted packets. An attacker can trigger CPU exhaustion and application hang by delivering a specially crafted OpenFlow v5 packet to a user running an affected version, requiring user interaction (opening a capture file or live packet capture). No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is known.
Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 are vulnerable to a denial of service attack via an infinite loop in the OpenFlow v6 protocol dissector, triggered when processing malformed OpenFlow traffic. A local attacker with user interaction can crash the Wireshark application by crafting a malicious packet capture file or live traffic stream, rendering packet analysis unavailable until the process is restarted. No authentication is required, and the CVSS score of 5.5 reflects local attack vector with high availability impact.
Infinite loop in the MBIM protocol dissector of Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing specially crafted MBIM packets. A local user with normal privileges can trigger the infinite loop via user interaction (opening a malicious packet capture file), causing the application to hang and become unresponsive. No code execution or data access is possible; impact is strictly availability.
Infinite loop in the RPKI-Router protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user privileges can trigger the vulnerability through crafted network traffic or pcap files opened in Wireshark, rendering the application unresponsive. No authentication required; user interaction (opening a file or capturing packets) is necessary. No public exploit code or active exploitation in CISA KEV identified at time of analysis.
Denial of service via crash in the GSM RP protocol dissector affects Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with user privileges can trigger a dissector crash by crafting a malicious GSM RP packet and inducing a user to open it, causing application termination and loss of packet capture session. CVSS 5.5 reflects local attack vector and user interaction requirement; no remote exploitation path identified.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed WebSocket protocol packets, enabling local denial of service. An attacker with the ability to trigger packet dissection-either by crafting a malicious PCAP file or intercepting traffic on a local network-can force the application to crash by supplying a WebSocket frame that triggers an unhandled error condition in the protocol dissector. The vulnerability requires user interaction (opening a file or navigating to a network interface) and operates at local scope, resulting in application unavailability rather than code execution.
Wireshark SMB2 protocol dissector crashes when processing malformed packets, causing denial of service in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with low privileges can trigger the crash by crafting a malicious SMB2 packet and inducing the user to open it in Wireshark, resulting in application termination and loss of packet capture capability. No public exploit code or active exploitation in the wild has been identified at the time of analysis.
Stack buffer overflow in Wireshark HTTP protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash when processing malformed HTTP packets, resulting in denial of service. Local attackers with ability to trigger packet analysis via user interaction can crash the application and disrupt network traffic inspection workflows.
Denial of service in Wireshark sharkd versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to crash the application via a heap buffer overflow. The vulnerability requires local access and user interaction (opening a malicious file or network capture), making it a low-to-moderate priority for networked analyst workstations but not a remote code execution risk.
Memory leak in Wireshark sharkd service versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger denial of service through exhaustion of system memory. The vulnerability stems from improper resource cleanup (CWE-401) during packet processing, enabling a local attacker with non-privileged access to crash the sharkd daemon or degrade system performance by repeatedly invoking operations that leak memory. No active exploitation has been confirmed at time of analysis, and exploitation requires local file system access combined with user interaction.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the UDS protocol dissector allows local attackers to crash the application by opening a specially crafted packet capture file. The vulnerability requires user interaction (opening a malicious file) and is triggered during packet dissection, affecting the availability of the analysis tool but not confidentiality or integrity.
Null pointer dereference in Wireshark sharkd 4.4.0-4.4.14 and 4.6.0-4.6.4 causes denial of service when processing crafted input, crashing the daemon. Local attackers with low privileges can trigger the crash via user interaction, rendering the packet analysis service unavailable. No authentication required, and publicly available exploit code does not appear to exist at time of analysis.
Wireshark versions 4.4.0-4.4.13 and 4.6.0-4.6.3 crash when processing malformed RF4CE Profile protocol packets, enabling local denial of service attacks through user interaction. An attacker can trigger an out-of-bounds read by supplying a specially crafted packet file to a target user, causing the application to become unavailable. No patch is currently available for this vulnerability.
NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service [CVSS 4.7 MEDIUM]
Wireshark 4.6.0-4.6.3 and 4.4.0-4.4.13 can be crashed through memory exhaustion in the USB HID protocol dissector when processing malformed packets. A local attacker with the ability to trigger packet analysis can cause a denial of service condition, and public exploit code exists for this vulnerability. No patch is currently available.
Denial of service in Wireshark 4.6.0-4.6.2 and 4.4.0-4.4.12 can be triggered through a malformed SOME/IP-SD protocol packet, causing the application to crash. Public exploit code exists for this vulnerability, and affected users should avoid opening untrusted packet captures until a patch is available.
BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service [CVSS 5.5 MEDIUM]
Null pointer dereference in Wireshark's X.509IF protocol dissector crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling remote denial of service against any instance processing affected traffic. An unauthenticated network attacker can trigger the crash by injecting a malformed X.509IF packet into traffic being captured or analyzed, with no privileges or user interaction required per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at the time of analysis, though the zero-complexity attack surface warrants prompt patching.
Wireshark's H.245 protocol dissector crashes on malformed H.245 packets across versions 4.6.0-4.6.7 and 4.4.0-4.4.17, enabling unauthenticated remote denial of service against any analyst actively capturing H.323 multimedia traffic. The null pointer dereference (CWE-476) is triggered automatically during dissection, requiring no user interaction beyond running Wireshark on a monitored network. No active exploitation or public proof-of-concept has been identified; EPSS probability sits at 0.10% (1st percentile) and SSVC classifies exploitation as none.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Denial of service in Wireshark's UMTS FP protocol dissector affects the 4.6.0-4.6.6 and 4.4.0-4.4.16 release branches, where a malformed UMTS Frame Protocol packet triggers a heap-based buffer overflow (CWE-122) that crashes the application. A remote attacker who can get the crafted frame parsed - via live capture on a monitored segment or a shared capture file - can reliably terminate the analyzer, with no confidentiality or integrity impact. Publicly available exploit code exists (SSVC=poc) but it is not on CISA KEV, and EPSS is low at 0.14% (4th percentile), indicating minimal observed exploitation pressure.
Denial of service in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 lets a remote attacker crash or hang the application by feeding it crafted packets that trigger infinite loops in multiple protocol dissectors. No public exploit is identified at time of analysis, and the flaw is limited to availability - no code execution or data exposure. Real-world urgency is modest: EPSS sits at 0.12% and CISA SSVC rates exploitation as 'none' with only partial technical impact.
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.9%.
Pcapng file parser crash in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18 enables denial of service via a locally-opened malformed capture file. Rooted in CWE-125 (Out-of-Bounds Read), the parser reads beyond an allocated buffer boundary when processing certain pcapng structures, causing application termination. No public exploit identified at time of analysis and not listed in CISA KEV; real-world risk is constrained by the local attack vector and required user interaction.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Wireshark's BLF file parser affects versions 4.6.0-4.6.6 and 4.4.0-4.4.16, stemming from use of an uninitialized variable (CWE-457) that may expose portions of process memory when parsing a crafted BLF file. Exploitation is constrained by a local attack vector, high attack complexity, and mandatory user interaction - a victim must actively open a malicious file. With a CVSS score of 2.5, no CISA KEV listing, and no public exploit identified at time of analysis, this is a low-priority finding with a narrow, socially-engineered attack surface.
Denial of service in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 is caused by a heap-based buffer overflow in the Catapult DCT2000 protocol dissector, crashing the application when a crafted capture file is opened. The CVSS local attack vector (AV:L) and required user interaction (UI:R) constrain exploitation to scenarios where an analyst is socially engineered into opening a malicious capture file - no remote or unauthenticated network exploitation path exists. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released fixes are available in 4.6.7 and 4.4.17.
The pcapng file parser in Wireshark 4.6.0 through 4.6.6 contains a heap-based buffer overflow (CWE-122) that crashes the application, resulting in denial of service. An attacker must convince a user to open a specially crafted pcapng capture file, making this a social-engineering-dependent attack with no network-facing exploitation path. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor patch is available in Wireshark 4.6.7.
The FMP/NOTIFY protocol dissector in Wireshark 4.6.0-4.6.6 and 4.4.0-4.4.16 crashes when processing malformed packet data, resulting in a denial of service against the application. Exploitation requires a victim to open a crafted packet capture file or analyze injected traffic, making this a social-engineering-dependent vector rather than a remotely triggerable flaw. A vendor-released patch is available in versions 4.6.7 and 4.4.17; no public exploit or CISA KEV listing has been identified at time of analysis.
Wireshark's SSH protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.4.0-4.4.16 and 4.6.0-4.6.6, enabling denial of service against any analyst or engineer running an affected build. The flaw is triggered locally when Wireshark processes malformed SSH protocol data, whether from a live capture or a crafted packet capture file, causing the application to crash and disrupting network analysis workflows. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis.
Heap-based buffer overflow in Wireshark's Z39.50 protocol dissector crashes the application when processing malformed Z39.50 PDUs, resulting in denial of service. Affected versions span the 4.4.x branch (4.4.0-4.4.16) and 4.6.x branch (4.6.0-4.6.6). An attacker can trigger the crash by persuading an analyst to open a crafted packet capture file or by injecting malicious Z39.50 traffic onto a monitored network segment; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Denial of service in Wireshark's DBS Etherwatch dissector affects release branches 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, where a malformed capture file or crafted packet can crash the application. The flaw is a stack-based buffer overflow (CWE-121) that manifests only as an availability impact - no confidentiality or integrity loss and no confirmed code execution - carrying a 7.5 (High) CVSS. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Stack-based buffer overflow in Wireshark's IEEE 802.11 (Wi-Fi) protocol dissector crashes the application, resulting in denial of service across versions 4.6.0-4.6.6 and 4.4.0-4.4.16. An attacker with the ability to deliver a malicious packet capture file, or inject crafted 802.11 frames into a live capture session, can crash the Wireshark process on a victim analyst's machine. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches (4.6.7 and 4.4.17) are available.
Denial of service in Wireshark 4.6.0 through 4.6.6 lets a remote attacker crash the application by feeding it a malformed TLS packet using the Encrypted Client Hello (ECH) extension, triggering a heap buffer overflow in the ECH decryptor. No authentication or user interaction beyond processing the traffic is required, though impact is limited to availability (analyzer crash) with no code execution or data disclosure claimed. Publicly available exploit code exists per SSVC (POC), EPSS is low at 0.14% (4th percentile), and it is not listed in CISA KEV.
Denial of service in Wireshark's ciscodump remote capture utility (extcap) affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, where a heap-based buffer overflow (CWE-122) can crash the capture tool. An attacker able to feed crafted data to a running ciscodump session can terminate the process, disrupting live packet capture. A POC is referenced by CISA's SSVC assessment (no public exploit code independently identified), it is not in CISA KEV, and EPSS is very low at 0.10% (1st percentile), indicating minimal likelihood of widespread exploitation.
Null pointer dereference in Wireshark's ROHC protocol dissector causes application crashes across two active release branches, constituting a denial-of-service condition. Affected versions span Wireshark 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15; patched releases 4.6.6 and 4.4.16 are available per the vendor advisory wnpa-sec-2026-51. The attack vector is local with required user interaction (CVSS AV:L/UI:R), meaning exploitation requires a victim to open a specially crafted packet capture file - no remote or automated exploitation path exists, and no public exploit code or active exploitation has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.4 crashes when processing malformed IEEE 802.11 frames due to a null pointer dereference in the protocol dissector. An attacker can trigger denial of service by crafting or replaying a specially malformed wireless packet that causes the dissector to crash when analyzed, rendering packet analysis impossible until the application restarts. CVSS score 5.5 reflects local attack vector with user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by parsing malformed K12 RF5 files with user interaction. The vulnerability stems from a buffer overflow in the K12 RF5 file parser, requiring an attacker to trick a user into opening a crafted file. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed Monero protocol packets causes application crash through unbounded recursion in the protocol dissector. Local attackers with user-level privileges can trigger the crash by opening a crafted pcap file or receiving a malicious network packet during live capture, requiring user interaction to open the malicious file but resulting in complete unavailability of the packet analysis tool.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed BT-DHT protocol packets, enabling local denial of service against users who open crafted capture files or sniff untrusted network traffic. The vulnerability requires local access and user interaction (opening a file or viewing live capture), but no authentication is required. EPSS exploitation probability is moderate given the low attack complexity and the prevalence of Wireshark in security operations.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed FC-SWILS (Fibre Channel Switch InterLink Service) protocol packets, enabling denial of service via local or remote delivery of a crafted packet file. The vulnerability requires user interaction (opening a malicious capture file), and no active exploitation has been confirmed at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in SMB2 protocol dissector allows local attackers to crash the application when processing malicious or malformed SMB2 network traffic. Exploitation requires user interaction (opening a crafted capture file or live capture), and causes high availability impact with no data confidentiality or integrity compromise. CVSS 5.5 reflects local attack vector but potential for widespread impact given Wireshark's role in network analysis workflows.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed ICMPv6 PvD (Prefix Validation Data) packets crashes the protocol dissector, requiring user interaction to open a crafted capture file. The vulnerability affects local users only (AV:L) and does not enable code execution, information disclosure, or integrity compromise.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed AFP Spotlight protocol packets, causing denial of service. An attacker can trigger the crash by delivering a crafted packet to a user running a vulnerable version, disrupting packet analysis and network monitoring. The vulnerability requires local or direct network access and user interaction to open a malicious capture file or receive the packet during live capture, but no authentication is needed.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via stack buffer overflow in the AMR-NB codec decoder allows local attackers with user interaction to crash the application. The vulnerability requires opening a specially crafted network capture file, making it exploitable in scenarios where users are tricked into opening untrusted PCAP files or when Wireshark auto-opens recent captures.
Denial of service in Wireshark 4.6.0 through 4.6.4 via crafted SDP protocol packets allows local attackers with user interaction to crash the application through a use-after-free memory corruption vulnerability in the SDP protocol dissector. EPSS and KEV status not available at analysis time; no public exploit code identified.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via crafted iLBC codec packets allows local attackers with user interaction to crash the application and interrupt service. The vulnerability stems from a use-after-free condition in the iLBC codec parser, triggered when Wireshark processes malformed audio codec data, causing an application crash without code execution.
Heap buffer overflow in the DCP-ETSI protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when a user opens a malicious packet capture file. The vulnerability requires user interaction (opening a crafted .pcap or similar file locally) and crashes the application, preventing further packet analysis. No public exploit code or active exploitation has been confirmed at this time.
Stack buffer overflow in Wireshark's BEEP protocol dissector causes denial of service when processing malformed network packets. Versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable; a local user with the ability to interact with Wireshark or supply crafted BEEP traffic can trigger a crash via a specially crafted packet that requires user interaction to open or process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in Wireshark's ZigBee protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash and denial of service when processing malformed ZigBee packets. An attacker must trick a user into opening a crafted packet capture file or visiting a malicious webpage serving the packet, since the vulnerability requires local file access and user interaction. No active exploitation has been publicly reported.
Wireshark versions 4.6.0 through 4.6.4 contain an infinite loop vulnerability in the DLMS/COSEM protocol dissector that causes denial of service when processing malformed packets. A local attacker with user privileges can trigger the infinite loop by opening a crafted DLMS/COSEM packet capture file, freezing the application and rendering it unresponsive without requiring authentication or special configuration.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes application crash during zlib decompression in the packet dissection engine when processing malformed compressed traffic. Local attackers with user privileges can trigger the crash by opening a specially crafted pcap file or receiving a malicious packet capture, requiring user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the USB HID protocol dissector allows local attackers to crash the application by opening a maliciously crafted packet capture file. The vulnerability requires user interaction (opening a file) on a local system, making it suitable for targeted attacks against security analysts and network administrators who routinely inspect suspicious network traffic.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by triggering an unhandled exception in the LZ77 decompression engine when processing malformed compressed packet data. The vulnerability requires user interaction (opening a crafted packet capture file or receiving a malicious packet) but causes immediate application termination, impacting network analysis workflows.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed Kismet protocol packets due to a buffer overflow in the Kismet dissector, allowing unauthenticated remote denial of service via a crafted network capture file or live traffic. User interaction (opening a malicious capture file or capturing traffic) is required. No public exploit code or active exploitation has been identified at the time of analysis.
Infinite loop in the SANE protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed SANE packets. A local attacker with user privileges can trigger the infinite loop by crafting a specially formatted SANE network capture or injecting malicious packets, causing Wireshark to hang and become unresponsive, denying analysts access to packet analysis.
Heap buffer overflow in Wireshark's DCP-ETSI protocol dissector causes denial of service when processing malformed network packets in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local user can trigger a crash by opening a crafted packet file or live network capture, rendering the packet analysis tool unresponsive. No remote exploitation or data exfiltration is possible; impact is limited to availability.
Heap buffer overflow in the iLBC audio codec dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger a denial of service crash by supplying a malformed iLBC packet. The vulnerability requires user interaction to open a crafted packet capture file and does not enable code execution.
Infinite loop in the TLS protocol dissector of Wireshark 4.6.0 through 4.6.4 causes denial of service when processing malformed TLS packets. Local attackers can trigger the infinite loop by crafting packets and opening them with Wireshark, causing the application to hang or consume excessive CPU resources. User interaction is required to open the malicious packet capture, limiting the attack to scenarios where a victim is tricked into opening untrusted network traffic files.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed ASN.1 PER protocol packets, enabling local denial of service against users opening crafted capture files. The vulnerability requires user interaction (opening a file or receiving a live packet capture) but allows an attacker to hang or crash the application without authentication. No active exploitation has been confirmed in public sources.
Denial of service in Wireshark 4.6.0 through 4.6.4 via null pointer dereference in the RTSP protocol dissector causes application crash when processing malformed RTSP traffic. Local attackers with network access to a Wireshark instance can trigger the crash by supplying a specially crafted RTSP packet, resulting in availability impact. No public exploit code or active in-the-wild exploitation has been identified; patch availability status requires verification from vendor.
Denial of service via MySQL protocol dissector crash in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local users with no privileges to crash the application through a crafted malicious pcap file or network capture, requiring only user interaction to open the file. The vulnerability stems from improper memory access in the MySQL dissector parser (CWE-824: Access of Uninitialized Pointer), resulting in application termination and loss of packet analysis capability. No public exploit code or active exploitation has been identified at time of analysis.
Infinite loop in the GNW protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user interaction can craft malicious GNW traffic or files to exhaust CPU resources and freeze the application, preventing legitimate packet analysis and potentially disrupting network troubleshooting workflows.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable to denial of service via infinite loops in the OpenFlow v5 protocol dissector when processing maliciously crafted packets. An attacker can trigger CPU exhaustion and application hang by delivering a specially crafted OpenFlow v5 packet to a user running an affected version, requiring user interaction (opening a capture file or live packet capture). No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is known.
Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 are vulnerable to a denial of service attack via an infinite loop in the OpenFlow v6 protocol dissector, triggered when processing malformed OpenFlow traffic. A local attacker with user interaction can crash the Wireshark application by crafting a malicious packet capture file or live traffic stream, rendering packet analysis unavailable until the process is restarted. No authentication is required, and the CVSS score of 5.5 reflects local attack vector with high availability impact.
Infinite loop in the MBIM protocol dissector of Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing specially crafted MBIM packets. A local user with normal privileges can trigger the infinite loop via user interaction (opening a malicious packet capture file), causing the application to hang and become unresponsive. No code execution or data access is possible; impact is strictly availability.
Infinite loop in the RPKI-Router protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user privileges can trigger the vulnerability through crafted network traffic or pcap files opened in Wireshark, rendering the application unresponsive. No authentication required; user interaction (opening a file or capturing packets) is necessary. No public exploit code or active exploitation in CISA KEV identified at time of analysis.
Denial of service via crash in the GSM RP protocol dissector affects Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with user privileges can trigger a dissector crash by crafting a malicious GSM RP packet and inducing a user to open it, causing application termination and loss of packet capture session. CVSS 5.5 reflects local attack vector and user interaction requirement; no remote exploitation path identified.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed WebSocket protocol packets, enabling local denial of service. An attacker with the ability to trigger packet dissection-either by crafting a malicious PCAP file or intercepting traffic on a local network-can force the application to crash by supplying a WebSocket frame that triggers an unhandled error condition in the protocol dissector. The vulnerability requires user interaction (opening a file or navigating to a network interface) and operates at local scope, resulting in application unavailability rather than code execution.
Wireshark SMB2 protocol dissector crashes when processing malformed packets, causing denial of service in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with low privileges can trigger the crash by crafting a malicious SMB2 packet and inducing the user to open it in Wireshark, resulting in application termination and loss of packet capture capability. No public exploit code or active exploitation in the wild has been identified at the time of analysis.
Stack buffer overflow in Wireshark HTTP protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash when processing malformed HTTP packets, resulting in denial of service. Local attackers with ability to trigger packet analysis via user interaction can crash the application and disrupt network traffic inspection workflows.
Denial of service in Wireshark sharkd versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to crash the application via a heap buffer overflow. The vulnerability requires local access and user interaction (opening a malicious file or network capture), making it a low-to-moderate priority for networked analyst workstations but not a remote code execution risk.
Memory leak in Wireshark sharkd service versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger denial of service through exhaustion of system memory. The vulnerability stems from improper resource cleanup (CWE-401) during packet processing, enabling a local attacker with non-privileged access to crash the sharkd daemon or degrade system performance by repeatedly invoking operations that leak memory. No active exploitation has been confirmed at time of analysis, and exploitation requires local file system access combined with user interaction.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the UDS protocol dissector allows local attackers to crash the application by opening a specially crafted packet capture file. The vulnerability requires user interaction (opening a malicious file) and is triggered during packet dissection, affecting the availability of the analysis tool but not confidentiality or integrity.
Null pointer dereference in Wireshark sharkd 4.4.0-4.4.14 and 4.6.0-4.6.4 causes denial of service when processing crafted input, crashing the daemon. Local attackers with low privileges can trigger the crash via user interaction, rendering the packet analysis service unavailable. No authentication required, and publicly available exploit code does not appear to exist at time of analysis.
Wireshark versions 4.4.0-4.4.13 and 4.6.0-4.6.3 crash when processing malformed RF4CE Profile protocol packets, enabling local denial of service attacks through user interaction. An attacker can trigger an out-of-bounds read by supplying a specially crafted packet file to a target user, causing the application to become unavailable. No patch is currently available for this vulnerability.
NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service [CVSS 4.7 MEDIUM]
Wireshark 4.6.0-4.6.3 and 4.4.0-4.4.13 can be crashed through memory exhaustion in the USB HID protocol dissector when processing malformed packets. A local attacker with the ability to trigger packet analysis can cause a denial of service condition, and public exploit code exists for this vulnerability. No patch is currently available.
Denial of service in Wireshark 4.6.0-4.6.2 and 4.4.0-4.4.12 can be triggered through a malformed SOME/IP-SD protocol packet, causing the application to crash. Public exploit code exists for this vulnerability, and affected users should avoid opening untrusted packet captures until a patch is available.
BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service [CVSS 5.5 MEDIUM]