The vulnerability is a logic error in Wireshark’s protocol dissectors that can cause an infinite loop when parsing certain packets or capture files. This loop consumes CPU and memory resources until the application becomes unresponsive, effectively denying service to users of the network monitoring tool. The flaw is identified as CWE‑835, a loop condition that never terminates. No remote code execution or privilege escalation is achieved; the impact is limited to the availability of the Wireshark process.

Wireshark Foundation’s Wireshark product is affected. Versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 contain the flaw. Versions older than 4.4.0 or later are not impacted.

The CVSS score of 5.5 and an EPSS score of less than 1% denote a very low chance of real-world exploitation. Based on the description, it is inferred that the attacker must deliver a malicious capture file or packet stream to the victim, making the vulnerability a local, user‑interaction‑dependent threat. Because the effect is limited to freezing Wireshark, there is no risk of data or system compromise beyond the loss of monitoring capability. The flaw is not listed in the CISA KEV catalog.