Wireshark Foundation
Monthly
Malformed SCTP traffic can crash the Wireshark/tshark dissector in versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, turning a heap-based buffer overflow (CWE-122) in the SCTP dissector into a denial of service against the analyst's own capture session rather than against any remote service. Exploitation requires the tool to process an attacker-supplied packet - either live-captured on a monitored interface carrying crafted SCTP traffic or opened from a malicious capture file - and the packet must be specifically malformed, which is why the high attack-complexity rating applies. Access requirements are unauthenticated per the CVSS vector (PR:N), and the realistic outcome is a crash of the Wireshark/tshark process, not code execution or host compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the originally supplied CVSS vector claimed high confidentiality and integrity impact, which the independent assessment corrected to availability-only (C:N/I:N/A:H).
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by processing attacker-controlled SPDY protocol data, an availability-only denial-of-service condition that our independent assessment scores as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests: exploitation requires the victim to open a crafted capture file or live-capture crafted SPDY traffic, publicly available exploit code exists, EPSS is only 0.45% (37th percentile), and there is no confirmed active exploitation (CISA KEV). Unauthenticated attackers can trigger the crash, but user interaction is mandatory and the impact is limited to terminating the Wireshark process, not code execution or data compromise.
Path traversal in Wireshark's configuration-profile import handler (CWE-22) allows a maliciously crafted profile to write files outside the intended profile directory, crashing the application and potentially achieving code execution in the user's context. Affected releases are Wireshark 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires the victim to manually import the attacker-supplied profile, so exploitation depends on social engineering rather than a network-facing or automatic trigger. Publicly available exploit code exists and the issue is tracked as wnpa-sec-2026-106, but it is not confirmed as actively exploited (CISA KEV) and EPSS is low at 0.19% (7th percentile), making this a moderate-priority issue rather than an emergency; patched releases 4.4.19 and 4.6.9 are available from the vendor.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a malformed X11 protocol message to crash the application via a heap-based buffer overflow in the X11 dissector. Exploitation requires a user to load a crafted capture file or dissect attacker-supplied live X11 traffic, giving a local, user-interaction-dependent vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) that, per the assessed vector, degrades only availability with no confidentiality or integrity impact - despite the vendor's 7.1 base score, which rated confidentiality high. Publicly available exploit code exists and CISA's SSVC rates the issue as proof-of-concept exploitation, not automatable, with partial technical impact; active exploitation is not indicated, and EPSS is only 0.13% (2nd percentile), so real-world risk is low. A vendor fix is available in 4.6.9 and 4.4.19.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Denial of service in Wireshark 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14: the AMR-NB codec dissector overflows a stack buffer (CWE-121) while processing crafted AMR-NB data, terminating the Wireshark process. The CVSS 3.1 vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is availability-only - no code execution, data disclosure or integrity effect is indicated. EPSS is low at 0.01% (2nd percentile) and the CVE is not in CISA KEV; a public PoC reference exists (the upstream GitLab issue cited in SSVC as exploitation: poc), but it is not verified as working exploit code. Vendor-released patches fix the two affected branches at 4.6.5 and 4.4.15.
Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 can be hung or crashed by dissecting attacker-supplied OpenFlow v6 traffic, because the OpenFlow v6 protocol dissector loops indefinitely instead of progressing through the packet. The impact is limited to denial of service on the analyst or monitoring workstation that parses the traffic - either live-captured on a monitored segment or contained in a capture file the analyst opens - with no confidentiality or integrity impact (C:N/I:N/A:H). Exploitation has not been reported and CISA SSVC marks exploitation as none and automatable as no, while EPSS sits at roughly 0.01%, so this is a genuine but low-urgency availability fix; vendor patches are available in 4.4.15 and 4.6.5.
An infinite loop in the MBIM protocol dissector of Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 lets remote attackers hang the application by getting it to parse a crafted MBIM frame, either from captured traffic or from an opened capture file. Impact is limited to denial of service - the dissector loops indefinitely, consuming CPU and stalling the Wireshark/TShark process, with no confidentiality or integrity effect (C:N/I:N/A:H, base score 7.5). Exploitation status is bounded: a public PoC reference exists but is not verified as working exploit code, SSVC marks the issue non-automatable, EPSS is 0.01% (2nd percentile), and no CISA KEV entry exists; the vulnerability is fixed in Wireshark 4.4.15 and 4.6.5.
Denial of service in the Wireshark UDS (Unified Diagnostic Services) protocol dissector: parsing certain crafted UDS traffic can drive the dissector into an infinite loop, leaving the application hung or unresponsive until it is killed. Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 are affected; fixed releases are 4.4.15 and 4.6.5. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H), no public exploit has been identified at time of analysis, EPSS is negligible at 0.01% (2nd percentile), and CISA SSVC records exploitation as none with automatable set to no, so this is a moderate-priority availability issue rather than a top-tier emergency.
Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.
An infinite loop in the TTL trace-file parser of Wireshark 4.6.0 through 4.6.8 lets a crafted capture file hang the application when an analyst opens it, producing a denial of service limited to the local Wireshark process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attacker cannot trigger the flaw remotely or without the victim manually opening the malicious TTL capture, and there is no confidentiality or integrity impact. No public exploit code or confirmed active exploitation was reported at the time of analysis, and no EPSS score was supplied, so the practical risk is low-priority availability loss rather than a broad compromise vector.
A NULL pointer dereference in Wireshark 4.6.0 through 4.6.8 allows a local user to crash the application by opening a crafted PEAK CAN TRC trace file, resulting in denial of service. The flaw requires user interaction to open a malicious file and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 5.5 with availability-only impact.
Memory leakage in Wireshark's IEEE C37.118 Synchrophasor protocol dissector allows a crafted packet capture to progressively exhaust process memory and crash the application on versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation requires a local user to open an attacker-supplied capture that actually contains malformed synchrophasor/PMU traffic, so the C37.118 dissector code path must run; the CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a local, unauthenticated but user-interaction-dependent trigger with availability-only impact. This is a low-priority, moderate-CVSS (5.5) availability bug with no confidentiality or integrity impact and no code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows an attacker to crash the application by supplying a crafted packet capture or frame that reaches the MBIM (Mobile Broadband Interface Model) protocol dissector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) shows the attack is local with no privileges required but requires user interaction - typically opening a malicious capture file - and the only impact is availability loss from a recoverable crash with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; consistent with the independent assessment, this is a low-priority, availability-only defect despite its medium 5.5 rating, and consumers of untrusted captures should still patch or restrict the MBIM dissector.
Heap-based buffer overflow in Wireshark's sharkd JSON-RPC backend (CVE-2026-95388) allows attacker-controlled packet-capture data to crash the local analysis process in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The issue is local and requires user interaction, because an analyst must load a malicious capture into sharkd, and it yields only denial of service (CVSS 5.5, AV:L/PR:N/UI:R, A:H). No public exploit identified at time of analysis, and the practical risk is limited to deployments that actually invoke the sharkd utility.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by a reachable-assertion failure in the Frame protocol metadissector, a local, user-assisted denial of service tracked as CVE-2026-96422 (CVSS 5.5, CWE-617). The attack vector is local and requires user interaction: an analyst must open or process a crafted capture file, or capture crafted live traffic that reaches the metadissector, after which the parser aborts the process; the impact is limited to availability (A:H) with no confidentiality or integrity effect and no code execution. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; authentication requirements are not confirmed from the available data, though the assessed vector (AV:L/PR:N/UI:R) indicates no privileges are needed beyond the victim loading the malicious input. Risk is genuine but low-urgency, confined to disruption of the analysis workflow.
Denial of service in Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 allows attackers to hang or exhaust memory in the Wireshark process by getting a user to open a crafted capture file containing malformed USB HID data. The flaw is an infinite loop and memory leak in the USB HID protocol dissector (CWE-1325); exploitation requires user interaction to load the file and cannot cause code execution or data disclosure. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 score is 5.5 (Medium) with high availability impact under a local vector.
Crashing denial-of-service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when the RF4CE protocol dissector processes a malformed packet, triggering a heap-based buffer overflow (CWE-122) that terminates the application. The attack is not remotely triggerable: a local user must be induced to open a crafted capture file (or start a live capture containing RF4CE-classified traffic), and no authentication is required (PR:N) while user interaction is mandatory (UI:R), so impact is confined to process availability with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published an advisory (wnpa-sec-2026-104) that should be consulted for the fixed release.
Malformed TIFF data processed by Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 causes the TIFF protocol dissector to loop indefinitely, hanging the application until it is killed manually. Exploitation is local and client-side (AV:L, UI:R): an attacker must convince an analyst to open a crafted capture file or dissect attacker-controlled traffic containing the malicious TIFF payload, and no privileges are required (PR:N). Impact is availability-only (C:N/I:N/A:H, CVSS 5.5) with no data disclosure, modification, or code execution, and no public exploit has been identified at time of analysis - this is a genuine but low-priority issue whose realistic risk is targeted social engineering of analysts rather than mass exploitation.
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can crash when a user opens a crafted capture file in the Toshiba ('compact router snoop') format, producing a denial-of-service condition limited to the affected process. The underlying issue is a buffer over-read (CWE-126) in the Toshiba wiretap parser; the supplied CVSS vector rates it as local, high-complexity, user-interaction-required, and availability-only, and the independent assessment calls it a genuine but low-priority issue. No public exploit was identified at time of analysis.
A heap-based buffer overflow in the IEEE 802.11 dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows local, unauthenticated attackers to cause a denial of service (application crash) by convincing a user to open a crafted packet capture file or by processing malicious live 802.11 traffic. The vulnerability requires user interaction and has only availability impact, with no confidentiality or integrity loss, and is considered low priority despite its Medium CVSS score of 5.5. No public exploit code or active exploitation has been identified at time of analysis; the IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious data.
Opening a crafted Catapult DCT2000 capture file in Wireshark 4.6.0 through 4.6.8 or 4.4.0 through 4.4.18 triggers a stack-based buffer overflow in the DCT2000 protocol dissector, terminating the application. The issue is local and client-side (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5): the analyst must actively load the malicious file or a capture whose packets are routed through the DCT2000 dissector, and no authentication is required per the vector, but user interaction is. Impact is limited to an availability loss - a crash of the Wireshark process - with no code execution, data disclosure, or integrity impact indicated. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor has published advisory wnpa-sec-2026-110 and an associated GitLab work item.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Null pointer dereference in Wireshark's ROHC protocol dissector causes application crashes across two active release branches, constituting a denial-of-service condition. Affected versions span Wireshark 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15; patched releases 4.6.6 and 4.4.16 are available per the vendor advisory wnpa-sec-2026-51. The attack vector is local with required user interaction (CVSS AV:L/UI:R), meaning exploitation requires a victim to open a specially crafted packet capture file - no remote or automated exploitation path exists, and no public exploit code or active exploitation has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.4 crashes when processing malformed IEEE 802.11 frames due to a null pointer dereference in the protocol dissector. An attacker can trigger denial of service by crafting or replaying a specially malformed wireless packet that causes the dissector to crash when analyzed, rendering packet analysis impossible until the application restarts. CVSS score 5.5 reflects local attack vector with user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by parsing malformed K12 RF5 files with user interaction. The vulnerability stems from a buffer overflow in the K12 RF5 file parser, requiring an attacker to trick a user into opening a crafted file. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed Monero protocol packets causes application crash through unbounded recursion in the protocol dissector. Local attackers with user-level privileges can trigger the crash by opening a crafted pcap file or receiving a malicious network packet during live capture, requiring user interaction to open the malicious file but resulting in complete unavailability of the packet analysis tool.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed BT-DHT protocol packets, enabling local denial of service against users who open crafted capture files or sniff untrusted network traffic. The vulnerability requires local access and user interaction (opening a file or viewing live capture), but no authentication is required. EPSS exploitation probability is moderate given the low attack complexity and the prevalence of Wireshark in security operations.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed FC-SWILS (Fibre Channel Switch InterLink Service) protocol packets, enabling denial of service via local or remote delivery of a crafted packet file. The vulnerability requires user interaction (opening a malicious capture file), and no active exploitation has been confirmed at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in SMB2 protocol dissector allows local attackers to crash the application when processing malicious or malformed SMB2 network traffic. Exploitation requires user interaction (opening a crafted capture file or live capture), and causes high availability impact with no data confidentiality or integrity compromise. CVSS 5.5 reflects local attack vector but potential for widespread impact given Wireshark's role in network analysis workflows.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed ICMPv6 PvD (Prefix Validation Data) packets crashes the protocol dissector, requiring user interaction to open a crafted capture file. The vulnerability affects local users only (AV:L) and does not enable code execution, information disclosure, or integrity compromise.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed AFP Spotlight protocol packets, causing denial of service. An attacker can trigger the crash by delivering a crafted packet to a user running a vulnerable version, disrupting packet analysis and network monitoring. The vulnerability requires local or direct network access and user interaction to open a malicious capture file or receive the packet during live capture, but no authentication is needed.
Denial of service in Wireshark 4.6.0 through 4.6.4 via crafted SDP protocol packets allows local attackers with user interaction to crash the application through a use-after-free memory corruption vulnerability in the SDP protocol dissector. EPSS and KEV status not available at analysis time; no public exploit code identified.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via crafted iLBC codec packets allows local attackers with user interaction to crash the application and interrupt service. The vulnerability stems from a use-after-free condition in the iLBC codec parser, triggered when Wireshark processes malformed audio codec data, causing an application crash without code execution.
Heap buffer overflow in the DCP-ETSI protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when a user opens a malicious packet capture file. The vulnerability requires user interaction (opening a crafted .pcap or similar file locally) and crashes the application, preventing further packet analysis. No public exploit code or active exploitation has been confirmed at this time.
Stack buffer overflow in Wireshark's BEEP protocol dissector causes denial of service when processing malformed network packets. Versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable; a local user with the ability to interact with Wireshark or supply crafted BEEP traffic can trigger a crash via a specially crafted packet that requires user interaction to open or process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in Wireshark's ZigBee protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash and denial of service when processing malformed ZigBee packets. An attacker must trick a user into opening a crafted packet capture file or visiting a malicious webpage serving the packet, since the vulnerability requires local file access and user interaction. No active exploitation has been publicly reported.
Wireshark versions 4.6.0 through 4.6.4 contain an infinite loop vulnerability in the DLMS/COSEM protocol dissector that causes denial of service when processing malformed packets. A local attacker with user privileges can trigger the infinite loop by opening a crafted DLMS/COSEM packet capture file, freezing the application and rendering it unresponsive without requiring authentication or special configuration.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes application crash during zlib decompression in the packet dissection engine when processing malformed compressed traffic. Local attackers with user privileges can trigger the crash by opening a specially crafted pcap file or receiving a malicious packet capture, requiring user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the USB HID protocol dissector allows local attackers to crash the application by opening a maliciously crafted packet capture file. The vulnerability requires user interaction (opening a file) on a local system, making it suitable for targeted attacks against security analysts and network administrators who routinely inspect suspicious network traffic.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by triggering an unhandled exception in the LZ77 decompression engine when processing malformed compressed packet data. The vulnerability requires user interaction (opening a crafted packet capture file or receiving a malicious packet) but causes immediate application termination, impacting network analysis workflows.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed Kismet protocol packets due to a buffer overflow in the Kismet dissector, allowing unauthenticated remote denial of service via a crafted network capture file or live traffic. User interaction (opening a malicious capture file or capturing traffic) is required. No public exploit code or active exploitation has been identified at the time of analysis.
Infinite loop in the SANE protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed SANE packets. A local attacker with user privileges can trigger the infinite loop by crafting a specially formatted SANE network capture or injecting malicious packets, causing Wireshark to hang and become unresponsive, denying analysts access to packet analysis.
Heap buffer overflow in Wireshark's DCP-ETSI protocol dissector causes denial of service when processing malformed network packets in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local user can trigger a crash by opening a crafted packet file or live network capture, rendering the packet analysis tool unresponsive. No remote exploitation or data exfiltration is possible; impact is limited to availability.
Heap buffer overflow in the iLBC audio codec dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger a denial of service crash by supplying a malformed iLBC packet. The vulnerability requires user interaction to open a crafted packet capture file and does not enable code execution.
Infinite loop in the TLS protocol dissector of Wireshark 4.6.0 through 4.6.4 causes denial of service when processing malformed TLS packets. Local attackers can trigger the infinite loop by crafting packets and opening them with Wireshark, causing the application to hang or consume excessive CPU resources. User interaction is required to open the malicious packet capture, limiting the attack to scenarios where a victim is tricked into opening untrusted network traffic files.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed ASN.1 PER protocol packets, enabling local denial of service against users opening crafted capture files. The vulnerability requires user interaction (opening a file or receiving a live packet capture) but allows an attacker to hang or crash the application without authentication. No active exploitation has been confirmed in public sources.
Denial of service in Wireshark 4.6.0 through 4.6.4 via null pointer dereference in the RTSP protocol dissector causes application crash when processing malformed RTSP traffic. Local attackers with network access to a Wireshark instance can trigger the crash by supplying a specially crafted RTSP packet, resulting in availability impact. No public exploit code or active in-the-wild exploitation has been identified; patch availability status requires verification from vendor.
Denial of service via MySQL protocol dissector crash in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local users with no privileges to crash the application through a crafted malicious pcap file or network capture, requiring only user interaction to open the file. The vulnerability stems from improper memory access in the MySQL dissector parser (CWE-824: Access of Uninitialized Pointer), resulting in application termination and loss of packet analysis capability. No public exploit code or active exploitation has been identified at time of analysis.
Infinite loop in the GNW protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user interaction can craft malicious GNW traffic or files to exhaust CPU resources and freeze the application, preventing legitimate packet analysis and potentially disrupting network troubleshooting workflows.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable to denial of service via infinite loops in the OpenFlow v5 protocol dissector when processing maliciously crafted packets. An attacker can trigger CPU exhaustion and application hang by delivering a specially crafted OpenFlow v5 packet to a user running an affected version, requiring user interaction (opening a capture file or live packet capture). No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is known.
Infinite loop in the RPKI-Router protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user privileges can trigger the vulnerability through crafted network traffic or pcap files opened in Wireshark, rendering the application unresponsive. No authentication required; user interaction (opening a file or capturing packets) is necessary. No public exploit code or active exploitation in CISA KEV identified at time of analysis.
Denial of service via crash in the GSM RP protocol dissector affects Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with user privileges can trigger a dissector crash by crafting a malicious GSM RP packet and inducing a user to open it, causing application termination and loss of packet capture session. CVSS 5.5 reflects local attack vector and user interaction requirement; no remote exploitation path identified.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed WebSocket protocol packets, enabling local denial of service. An attacker with the ability to trigger packet dissection-either by crafting a malicious PCAP file or intercepting traffic on a local network-can force the application to crash by supplying a WebSocket frame that triggers an unhandled error condition in the protocol dissector. The vulnerability requires user interaction (opening a file or navigating to a network interface) and operates at local scope, resulting in application unavailability rather than code execution.
Wireshark SMB2 protocol dissector crashes when processing malformed packets, causing denial of service in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with low privileges can trigger the crash by crafting a malicious SMB2 packet and inducing the user to open it in Wireshark, resulting in application termination and loss of packet capture capability. No public exploit code or active exploitation in the wild has been identified at the time of analysis.
Stack buffer overflow in Wireshark HTTP protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash when processing malformed HTTP packets, resulting in denial of service. Local attackers with ability to trigger packet analysis via user interaction can crash the application and disrupt network traffic inspection workflows.
Denial of service in Wireshark sharkd versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to crash the application via a heap buffer overflow. The vulnerability requires local access and user interaction (opening a malicious file or network capture), making it a low-to-moderate priority for networked analyst workstations but not a remote code execution risk.
Memory leak in Wireshark sharkd service versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger denial of service through exhaustion of system memory. The vulnerability stems from improper resource cleanup (CWE-401) during packet processing, enabling a local attacker with non-privileged access to crash the sharkd daemon or degrade system performance by repeatedly invoking operations that leak memory. No active exploitation has been confirmed at time of analysis, and exploitation requires local file system access combined with user interaction.
Null pointer dereference in Wireshark sharkd 4.4.0-4.4.14 and 4.6.0-4.6.4 causes denial of service when processing crafted input, crashing the daemon. Local attackers with low privileges can trigger the crash via user interaction, rendering the packet analysis service unavailable. No authentication required, and publicly available exploit code does not appear to exist at time of analysis.
Malformed SCTP traffic can crash the Wireshark/tshark dissector in versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, turning a heap-based buffer overflow (CWE-122) in the SCTP dissector into a denial of service against the analyst's own capture session rather than against any remote service. Exploitation requires the tool to process an attacker-supplied packet - either live-captured on a monitored interface carrying crafted SCTP traffic or opened from a malicious capture file - and the packet must be specifically malformed, which is why the high attack-complexity rating applies. Access requirements are unauthenticated per the CVSS vector (PR:N), and the realistic outcome is a crash of the Wireshark/tshark process, not code execution or host compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the originally supplied CVSS vector claimed high confidentiality and integrity impact, which the independent assessment corrected to availability-only (C:N/I:N/A:H).
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by processing attacker-controlled SPDY protocol data, an availability-only denial-of-service condition that our independent assessment scores as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests: exploitation requires the victim to open a crafted capture file or live-capture crafted SPDY traffic, publicly available exploit code exists, EPSS is only 0.45% (37th percentile), and there is no confirmed active exploitation (CISA KEV). Unauthenticated attackers can trigger the crash, but user interaction is mandatory and the impact is limited to terminating the Wireshark process, not code execution or data compromise.
Path traversal in Wireshark's configuration-profile import handler (CWE-22) allows a maliciously crafted profile to write files outside the intended profile directory, crashing the application and potentially achieving code execution in the user's context. Affected releases are Wireshark 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires the victim to manually import the attacker-supplied profile, so exploitation depends on social engineering rather than a network-facing or automatic trigger. Publicly available exploit code exists and the issue is tracked as wnpa-sec-2026-106, but it is not confirmed as actively exploited (CISA KEV) and EPSS is low at 0.19% (7th percentile), making this a moderate-priority issue rather than an emergency; patched releases 4.4.19 and 4.6.9 are available from the vendor.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a malformed X11 protocol message to crash the application via a heap-based buffer overflow in the X11 dissector. Exploitation requires a user to load a crafted capture file or dissect attacker-supplied live X11 traffic, giving a local, user-interaction-dependent vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) that, per the assessed vector, degrades only availability with no confidentiality or integrity impact - despite the vendor's 7.1 base score, which rated confidentiality high. Publicly available exploit code exists and CISA's SSVC rates the issue as proof-of-concept exploitation, not automatable, with partial technical impact; active exploitation is not indicated, and EPSS is only 0.13% (2nd percentile), so real-world risk is low. A vendor fix is available in 4.6.9 and 4.4.19.
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.
Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Heap buffer overflow in Wireshark's SBC codec handler enables local code execution when processing malicious capture files. Affects Wireshark versions 4.4.0-4.4.14 and 4.6.0-4.6.4. The vulnerability requires user interaction (opening a crafted packet capture file) but no authentication, posing significant risk to network analysts who routinely process captures from untrusted sources. Wireshark Foundation has published security advisory WNPA-sec-2026-16 with remediation details. EPSS probability data not available; no evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Path traversal via profile import in Wireshark lets a malicious configuration profile archive write files outside the intended profile directory, causing denial of service and potentially arbitrary code execution when a user imports it. Affected builds are Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14, with the flaw triggered by user interaction (importing a crafted profile) rather than network traffic. EPSS is very low (0.01%) and there is no public exploit identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Wireshark's RDP protocol dissector allows local attackers to cause denial of service or execute arbitrary code via maliciously crafted capture files. Affects Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14. The vulnerability requires user interaction (opening a malicious .pcap file) but no authentication, making it effective for social engineering attacks against network analysts. No active exploitation confirmed in CISA KEV, but proof-of-concept details available via GitLab issue tracker. EPSS data not available for risk prioritization.
Heap overflow in Wireshark 4.6.0 through 4.6.4 TLS protocol dissector enables remote code execution when a user opens a malicious capture file or inspects crafted network traffic. The vulnerability requires user interaction (UI:R) but no authentication, making it exploitable via social engineering. No public exploit code identified at time of analysis, though the technical details are disclosed in vendor advisory wnpa-sec-2026-14 and tracked in GitLab issue #21090. CVSS 8.8 reflects the combination of network vector, low complexity, and potential for complete system compromise despite the user interaction requirement.
Denial of service in Wireshark 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14: the AMR-NB codec dissector overflows a stack buffer (CWE-121) while processing crafted AMR-NB data, terminating the Wireshark process. The CVSS 3.1 vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is availability-only - no code execution, data disclosure or integrity effect is indicated. EPSS is low at 0.01% (2nd percentile) and the CVE is not in CISA KEV; a public PoC reference exists (the upstream GitLab issue cited in SSVC as exploitation: poc), but it is not verified as working exploit code. Vendor-released patches fix the two affected branches at 4.6.5 and 4.4.15.
Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 can be hung or crashed by dissecting attacker-supplied OpenFlow v6 traffic, because the OpenFlow v6 protocol dissector loops indefinitely instead of progressing through the packet. The impact is limited to denial of service on the analyst or monitoring workstation that parses the traffic - either live-captured on a monitored segment or contained in a capture file the analyst opens - with no confidentiality or integrity impact (C:N/I:N/A:H). Exploitation has not been reported and CISA SSVC marks exploitation as none and automatable as no, while EPSS sits at roughly 0.01%, so this is a genuine but low-urgency availability fix; vendor patches are available in 4.4.15 and 4.6.5.
An infinite loop in the MBIM protocol dissector of Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 lets remote attackers hang the application by getting it to parse a crafted MBIM frame, either from captured traffic or from an opened capture file. Impact is limited to denial of service - the dissector loops indefinitely, consuming CPU and stalling the Wireshark/TShark process, with no confidentiality or integrity effect (C:N/I:N/A:H, base score 7.5). Exploitation status is bounded: a public PoC reference exists but is not verified as working exploit code, SSVC marks the issue non-automatable, EPSS is 0.01% (2nd percentile), and no CISA KEV entry exists; the vulnerability is fixed in Wireshark 4.4.15 and 4.6.5.
Denial of service in the Wireshark UDS (Unified Diagnostic Services) protocol dissector: parsing certain crafted UDS traffic can drive the dissector into an infinite loop, leaving the application hung or unresponsive until it is killed. Wireshark 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 are affected; fixed releases are 4.4.15 and 4.6.5. Only availability is impacted (CVSS 7.5, C:N/I:N/A:H), no public exploit has been identified at time of analysis, EPSS is negligible at 0.01% (2nd percentile), and CISA SSVC records exploitation as none with automatable set to no, so this is a moderate-priority availability issue rather than a top-tier emergency.
Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.
An infinite loop in the TTL trace-file parser of Wireshark 4.6.0 through 4.6.8 lets a crafted capture file hang the application when an analyst opens it, producing a denial of service limited to the local Wireshark process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attacker cannot trigger the flaw remotely or without the victim manually opening the malicious TTL capture, and there is no confidentiality or integrity impact. No public exploit code or confirmed active exploitation was reported at the time of analysis, and no EPSS score was supplied, so the practical risk is low-priority availability loss rather than a broad compromise vector.
A NULL pointer dereference in Wireshark 4.6.0 through 4.6.8 allows a local user to crash the application by opening a crafted PEAK CAN TRC trace file, resulting in denial of service. The flaw requires user interaction to open a malicious file and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 5.5 with availability-only impact.
Memory leakage in Wireshark's IEEE C37.118 Synchrophasor protocol dissector allows a crafted packet capture to progressively exhaust process memory and crash the application on versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation requires a local user to open an attacker-supplied capture that actually contains malformed synchrophasor/PMU traffic, so the C37.118 dissector code path must run; the CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a local, unauthenticated but user-interaction-dependent trigger with availability-only impact. This is a low-priority, moderate-CVSS (5.5) availability bug with no confidentiality or integrity impact and no code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows an attacker to crash the application by supplying a crafted packet capture or frame that reaches the MBIM (Mobile Broadband Interface Model) protocol dissector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) shows the attack is local with no privileges required but requires user interaction - typically opening a malicious capture file - and the only impact is availability loss from a recoverable crash with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; consistent with the independent assessment, this is a low-priority, availability-only defect despite its medium 5.5 rating, and consumers of untrusted captures should still patch or restrict the MBIM dissector.
Heap-based buffer overflow in Wireshark's sharkd JSON-RPC backend (CVE-2026-95388) allows attacker-controlled packet-capture data to crash the local analysis process in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The issue is local and requires user interaction, because an analyst must load a malicious capture into sharkd, and it yields only denial of service (CVSS 5.5, AV:L/PR:N/UI:R, A:H). No public exploit identified at time of analysis, and the practical risk is limited to deployments that actually invoke the sharkd utility.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by a reachable-assertion failure in the Frame protocol metadissector, a local, user-assisted denial of service tracked as CVE-2026-96422 (CVSS 5.5, CWE-617). The attack vector is local and requires user interaction: an analyst must open or process a crafted capture file, or capture crafted live traffic that reaches the metadissector, after which the parser aborts the process; the impact is limited to availability (A:H) with no confidentiality or integrity effect and no code execution. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; authentication requirements are not confirmed from the available data, though the assessed vector (AV:L/PR:N/UI:R) indicates no privileges are needed beyond the victim loading the malicious input. Risk is genuine but low-urgency, confined to disruption of the analysis workflow.
Denial of service in Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 allows attackers to hang or exhaust memory in the Wireshark process by getting a user to open a crafted capture file containing malformed USB HID data. The flaw is an infinite loop and memory leak in the USB HID protocol dissector (CWE-1325); exploitation requires user interaction to load the file and cannot cause code execution or data disclosure. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 score is 5.5 (Medium) with high availability impact under a local vector.
Crashing denial-of-service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when the RF4CE protocol dissector processes a malformed packet, triggering a heap-based buffer overflow (CWE-122) that terminates the application. The attack is not remotely triggerable: a local user must be induced to open a crafted capture file (or start a live capture containing RF4CE-classified traffic), and no authentication is required (PR:N) while user interaction is mandatory (UI:R), so impact is confined to process availability with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published an advisory (wnpa-sec-2026-104) that should be consulted for the fixed release.
Malformed TIFF data processed by Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 causes the TIFF protocol dissector to loop indefinitely, hanging the application until it is killed manually. Exploitation is local and client-side (AV:L, UI:R): an attacker must convince an analyst to open a crafted capture file or dissect attacker-controlled traffic containing the malicious TIFF payload, and no privileges are required (PR:N). Impact is availability-only (C:N/I:N/A:H, CVSS 5.5) with no data disclosure, modification, or code execution, and no public exploit has been identified at time of analysis - this is a genuine but low-priority issue whose realistic risk is targeted social engineering of analysts rather than mass exploitation.
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can crash when a user opens a crafted capture file in the Toshiba ('compact router snoop') format, producing a denial-of-service condition limited to the affected process. The underlying issue is a buffer over-read (CWE-126) in the Toshiba wiretap parser; the supplied CVSS vector rates it as local, high-complexity, user-interaction-required, and availability-only, and the independent assessment calls it a genuine but low-priority issue. No public exploit was identified at time of analysis.
A heap-based buffer overflow in the IEEE 802.11 dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows local, unauthenticated attackers to cause a denial of service (application crash) by convincing a user to open a crafted packet capture file or by processing malicious live 802.11 traffic. The vulnerability requires user interaction and has only availability impact, with no confidentiality or integrity loss, and is considered low priority despite its Medium CVSS score of 5.5. No public exploit code or active exploitation has been identified at time of analysis; the IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious data.
Opening a crafted Catapult DCT2000 capture file in Wireshark 4.6.0 through 4.6.8 or 4.4.0 through 4.4.18 triggers a stack-based buffer overflow in the DCT2000 protocol dissector, terminating the application. The issue is local and client-side (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5): the analyst must actively load the malicious file or a capture whose packets are routed through the DCT2000 dissector, and no authentication is required per the vector, but user interaction is. Impact is limited to an availability loss - a crash of the Wireshark process - with no code execution, data disclosure, or integrity impact indicated. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor has published advisory wnpa-sec-2026-110 and an associated GitLab work item.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Wireshark's Bluetooth BR/EDR FHS protocol dissector crashes via a NULL pointer dereference (CWE-476) when processing a malformed packet capture, affecting the 4.6.x branch (4.6.0-4.6.7) and the 4.4.x branch (4.4.0-4.4.18). An attacker who can persuade a user to open a specially crafted capture file can crash the Wireshark process, resulting in an application-level denial of service with no confidentiality or integrity impact. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS data was not included in the available intelligence.
Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.
Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.
Heap-based buffer overflow in Wireshark's SSH protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application and causing denial of service. An attacker delivers a crafted network capture file or malformed live SSH traffic; when a user opens or captures it with an affected Wireshark build, the dissector overflows a heap buffer and terminates the process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Wireshark's Bluetooth AVRCP protocol dissector crashes the application when processing malformed AVRCP packets, enabling denial of service against versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The CVSS vector (AV:L/UI:R) indicates the attack requires a user to open or process a crafted packet capture file - this is not a remotely triggerable crash but a file-based DoS vector typical of Wireshark dissector flaws. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Wireshark's UMTS FP protocol dissector crashes the application across affected 4.4.x and 4.6.x releases, enabling denial of service against network analysts and security teams. Wireshark versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7 are vulnerable when a user opens a specially crafted capture file or captures live traffic containing a malformed UMTS FP frame. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available in versions 4.6.8 and 4.4.18.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Denial of service in Wireshark's Catapult DCT2000 file parser crashes the application across versions 4.6.0-4.6.7 and 4.4.0-4.4.17 when a malformed capture file is opened. The root cause is a heap-based buffer overflow (CWE-122) that exhausts availability without yielding code execution, as confirmed by the CVSS A:H, C:N, I:N profile. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the moderate-priority tier despite the memory safety class of the flaw.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Wireshark's CMS protocol dissector crashes via a null pointer dereference (CWE-476) in versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, allowing denial of service against the application. An attacker can cause Wireshark to crash by inducing a user to open a malformed capture file or by injecting crafted CMS protocol traffic into a live capture session. No public exploit has been identified at time of analysis, and the CVSS local attack vector combined with high complexity limits realistic exposure to targeted scenarios.
Heap-based buffer overflow in Wireshark's TTX Logger file parser affects versions 4.6.0 through 4.6.7, causing application crashes and denial of service when a user opens a specially crafted TTX Logger file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow) and is classified as medium severity with a CVSS score of 4.7. No active exploitation has been identified at time of analysis, and exploitation requires local file access combined with user interaction, substantially limiting real-world exposure.
Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Null pointer dereference in Wireshark's ROHC protocol dissector causes application crashes across two active release branches, constituting a denial-of-service condition. Affected versions span Wireshark 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15; patched releases 4.6.6 and 4.4.16 are available per the vendor advisory wnpa-sec-2026-51. The attack vector is local with required user interaction (CVSS AV:L/UI:R), meaning exploitation requires a victim to open a specially crafted packet capture file - no remote or automated exploitation path exists, and no public exploit code or active exploitation has been identified at time of analysis.
Wireshark 4.6.0 through 4.6.4 crashes when processing malformed IEEE 802.11 frames due to a null pointer dereference in the protocol dissector. An attacker can trigger denial of service by crafting or replaying a specially malformed wireless packet that causes the dissector to crash when analyzed, rendering packet analysis impossible until the application restarts. CVSS score 5.5 reflects local attack vector with user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by parsing malformed K12 RF5 files with user interaction. The vulnerability stems from a buffer overflow in the K12 RF5 file parser, requiring an attacker to trick a user into opening a crafted file. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed Monero protocol packets causes application crash through unbounded recursion in the protocol dissector. Local attackers with user-level privileges can trigger the crash by opening a crafted pcap file or receiving a malicious network packet during live capture, requiring user interaction to open the malicious file but resulting in complete unavailability of the packet analysis tool.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed BT-DHT protocol packets, enabling local denial of service against users who open crafted capture files or sniff untrusted network traffic. The vulnerability requires local access and user interaction (opening a file or viewing live capture), but no authentication is required. EPSS exploitation probability is moderate given the low attack complexity and the prevalence of Wireshark in security operations.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed FC-SWILS (Fibre Channel Switch InterLink Service) protocol packets, enabling denial of service via local or remote delivery of a crafted packet file. The vulnerability requires user interaction (opening a malicious capture file), and no active exploitation has been confirmed at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in SMB2 protocol dissector allows local attackers to crash the application when processing malicious or malformed SMB2 network traffic. Exploitation requires user interaction (opening a crafted capture file or live capture), and causes high availability impact with no data confidentiality or integrity compromise. CVSS 5.5 reflects local attack vector but potential for widespread impact given Wireshark's role in network analysis workflows.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via malformed ICMPv6 PvD (Prefix Validation Data) packets crashes the protocol dissector, requiring user interaction to open a crafted capture file. The vulnerability affects local users only (AV:L) and does not enable code execution, information disclosure, or integrity compromise.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed AFP Spotlight protocol packets, causing denial of service. An attacker can trigger the crash by delivering a crafted packet to a user running a vulnerable version, disrupting packet analysis and network monitoring. The vulnerability requires local or direct network access and user interaction to open a malicious capture file or receive the packet during live capture, but no authentication is needed.
Denial of service in Wireshark 4.6.0 through 4.6.4 via crafted SDP protocol packets allows local attackers with user interaction to crash the application through a use-after-free memory corruption vulnerability in the SDP protocol dissector. EPSS and KEV status not available at analysis time; no public exploit code identified.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via crafted iLBC codec packets allows local attackers with user interaction to crash the application and interrupt service. The vulnerability stems from a use-after-free condition in the iLBC codec parser, triggered when Wireshark processes malformed audio codec data, causing an application crash without code execution.
Heap buffer overflow in the DCP-ETSI protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when a user opens a malicious packet capture file. The vulnerability requires user interaction (opening a crafted .pcap or similar file locally) and crashes the application, preventing further packet analysis. No public exploit code or active exploitation has been confirmed at this time.
Stack buffer overflow in Wireshark's BEEP protocol dissector causes denial of service when processing malformed network packets. Versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable; a local user with the ability to interact with Wireshark or supply crafted BEEP traffic can trigger a crash via a specially crafted packet that requires user interaction to open or process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in Wireshark's ZigBee protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash and denial of service when processing malformed ZigBee packets. An attacker must trick a user into opening a crafted packet capture file or visiting a malicious webpage serving the packet, since the vulnerability requires local file access and user interaction. No active exploitation has been publicly reported.
Wireshark versions 4.6.0 through 4.6.4 contain an infinite loop vulnerability in the DLMS/COSEM protocol dissector that causes denial of service when processing malformed packets. A local attacker with user privileges can trigger the infinite loop by opening a crafted DLMS/COSEM packet capture file, freezing the application and rendering it unresponsive without requiring authentication or special configuration.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes application crash during zlib decompression in the packet dissection engine when processing malformed compressed traffic. Local attackers with user privileges can trigger the crash by opening a specially crafted pcap file or receiving a malicious packet capture, requiring user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via infinite loop in the USB HID protocol dissector allows local attackers to crash the application by opening a maliciously crafted packet capture file. The vulnerability requires user interaction (opening a file) on a local system, making it suitable for targeted attacks against security analysts and network administrators who routinely inspect suspicious network traffic.
Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers to crash the application by triggering an unhandled exception in the LZ77 decompression engine when processing malformed compressed packet data. The vulnerability requires user interaction (opening a crafted packet capture file or receiving a malicious packet) but causes immediate application termination, impacting network analysis workflows.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed Kismet protocol packets due to a buffer overflow in the Kismet dissector, allowing unauthenticated remote denial of service via a crafted network capture file or live traffic. User interaction (opening a malicious capture file or capturing traffic) is required. No public exploit code or active exploitation has been identified at the time of analysis.
Infinite loop in the SANE protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed SANE packets. A local attacker with user privileges can trigger the infinite loop by crafting a specially formatted SANE network capture or injecting malicious packets, causing Wireshark to hang and become unresponsive, denying analysts access to packet analysis.
Heap buffer overflow in Wireshark's DCP-ETSI protocol dissector causes denial of service when processing malformed network packets in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local user can trigger a crash by opening a crafted packet file or live network capture, rendering the packet analysis tool unresponsive. No remote exploitation or data exfiltration is possible; impact is limited to availability.
Heap buffer overflow in the iLBC audio codec dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger a denial of service crash by supplying a malformed iLBC packet. The vulnerability requires user interaction to open a crafted packet capture file and does not enable code execution.
Infinite loop in the TLS protocol dissector of Wireshark 4.6.0 through 4.6.4 causes denial of service when processing malformed TLS packets. Local attackers can trigger the infinite loop by crafting packets and opening them with Wireshark, causing the application to hang or consume excessive CPU resources. User interaction is required to open the malicious packet capture, limiting the attack to scenarios where a victim is tricked into opening untrusted network traffic files.
Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed ASN.1 PER protocol packets, enabling local denial of service against users opening crafted capture files. The vulnerability requires user interaction (opening a file or receiving a live packet capture) but allows an attacker to hang or crash the application without authentication. No active exploitation has been confirmed in public sources.
Denial of service in Wireshark 4.6.0 through 4.6.4 via null pointer dereference in the RTSP protocol dissector causes application crash when processing malformed RTSP traffic. Local attackers with network access to a Wireshark instance can trigger the crash by supplying a specially crafted RTSP packet, resulting in availability impact. No public exploit code or active in-the-wild exploitation has been identified; patch availability status requires verification from vendor.
Denial of service via MySQL protocol dissector crash in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local users with no privileges to crash the application through a crafted malicious pcap file or network capture, requiring only user interaction to open the file. The vulnerability stems from improper memory access in the MySQL dissector parser (CWE-824: Access of Uninitialized Pointer), resulting in application termination and loss of packet analysis capability. No public exploit code or active exploitation has been identified at time of analysis.
Infinite loop in the GNW protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user interaction can craft malicious GNW traffic or files to exhaust CPU resources and freeze the application, preventing legitimate packet analysis and potentially disrupting network troubleshooting workflows.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 are vulnerable to denial of service via infinite loops in the OpenFlow v5 protocol dissector when processing maliciously crafted packets. An attacker can trigger CPU exhaustion and application hang by delivering a specially crafted OpenFlow v5 packet to a user running an affected version, requiring user interaction (opening a capture file or live packet capture). No public exploit code has been identified, but the vulnerability is straightforward to trigger once the root cause is known.
Infinite loop in the RPKI-Router protocol dissector in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 causes denial of service when processing malformed packets. Local attackers with user privileges can trigger the vulnerability through crafted network traffic or pcap files opened in Wireshark, rendering the application unresponsive. No authentication required; user interaction (opening a file or capturing packets) is necessary. No public exploit code or active exploitation in CISA KEV identified at time of analysis.
Denial of service via crash in the GSM RP protocol dissector affects Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with user privileges can trigger a dissector crash by crafting a malicious GSM RP packet and inducing a user to open it, causing application termination and loss of packet capture session. CVSS 5.5 reflects local attack vector and user interaction requirement; no remote exploitation path identified.
Wireshark versions 4.6.0-4.6.4 and 4.4.0-4.4.14 crash when processing malformed WebSocket protocol packets, enabling local denial of service. An attacker with the ability to trigger packet dissection-either by crafting a malicious PCAP file or intercepting traffic on a local network-can force the application to crash by supplying a WebSocket frame that triggers an unhandled error condition in the protocol dissector. The vulnerability requires user interaction (opening a file or navigating to a network interface) and operates at local scope, resulting in application unavailability rather than code execution.
Wireshark SMB2 protocol dissector crashes when processing malformed packets, causing denial of service in versions 4.6.0-4.6.4 and 4.4.0-4.4.14. A local attacker with low privileges can trigger the crash by crafting a malicious SMB2 packet and inducing the user to open it in Wireshark, resulting in application termination and loss of packet capture capability. No public exploit code or active exploitation in the wild has been identified at the time of analysis.
Stack buffer overflow in Wireshark HTTP protocol dissector (versions 4.6.0-4.6.4 and 4.4.0-4.4.14) causes application crash when processing malformed HTTP packets, resulting in denial of service. Local attackers with ability to trigger packet analysis via user interaction can crash the application and disrupt network traffic inspection workflows.
Denial of service in Wireshark sharkd versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to crash the application via a heap buffer overflow. The vulnerability requires local access and user interaction (opening a malicious file or network capture), making it a low-to-moderate priority for networked analyst workstations but not a remote code execution risk.
Memory leak in Wireshark sharkd service versions 4.6.0-4.6.4 and 4.4.0-4.4.14 allows local attackers with user interaction to trigger denial of service through exhaustion of system memory. The vulnerability stems from improper resource cleanup (CWE-401) during packet processing, enabling a local attacker with non-privileged access to crash the sharkd daemon or degrade system performance by repeatedly invoking operations that leak memory. No active exploitation has been confirmed at time of analysis, and exploitation requires local file system access combined with user interaction.
Null pointer dereference in Wireshark sharkd 4.4.0-4.4.14 and 4.6.0-4.6.4 causes denial of service when processing crafted input, crashing the daemon. Local attackers with low privileges can trigger the crash via user interaction, rendering the packet analysis service unavailable. No authentication required, and publicly available exploit code does not appear to exist at time of analysis.