A heap‑based buffer overflow exists in the UMTS FP protocol dissector of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16, causing the application to crash when a user opens or imports a capture file that contains a specifically crafted UMTS FP packet. The flaw is a classic CWE‑122 buffer overflow that results in denial of service, allowing an attacker to disrupt the availability of the Wireshark process for the user.

The vulnerability impacts Wireshark releases from the Wireshark Foundation. Affected versions are 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. All other Wireshark releases are not affected.

With a CVSS score of 5.5 the vulnerability is of moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation. The attack vector is inferred to be local or remote delivery of a malicious capture file that triggers the UMTS FP dissector, resulting in a controlled crash and denial of service for the victim user. No privilege escalation or data disclosure occurs, but repeated exploitation can deny users access to Wireshark for network analysis.