The vulnerability is an infinite loop in Wireshark’s HTTP/3 dissector that can be triggered when the program processes HTTP/3 traffic. Based on the description, the loop consumes CPU and memory resources without terminating, causing the Wireshark application to become unresponsive. The weakness is a loop with unreachable exit condition, identified as CWE‑835. The immediate consequence is denial of service for the analysis tool and potentially for the host if the application dominates system resources.

Affected systems are users of the Wireshark Foundation distribution running versions 4.6.0 through 4.6.2 inclusive. The issue does not affect earlier releases or the patched 4.6.3 and later versions. All builds that include the HTTP/3 dissector in the vulnerable range are potentially affected.

The CVSS score is 4.7, indicating moderate severity. The EPSS score is less than 1%, showing a low probability of exploitation. It is not listed in CISA's KEV catalog. Based on the description, the exploit likely requires traffic that triggers the HTTP/3 dissector to enter the infinite loop; an attacker could craft a packet dump or send network traffic containing such packets. Since Wireshark typically runs under user privileges, the impact is limited to denial of service of the application rather than privilege escalation or data exfiltration. However, if the application consumes significant system resources, the underlying host could be affected indirectly.