The vulnerability is a heap‑based buffer overflow (CWE‑122) caused by incorrect size handling (CWE‑131) in the Z39.50 protocol dissector of Wireshark. The CVE states that this flaw can be exploited to cause a denial of service. The precise nature of the overflow and whether it writes beyond allocated memory are not explicitly described and are inferred from typical heap overflow behavior.

Wireshark Foundation’s Wireshark software is affected. Versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 contain the flaw. The vendor has released a fix in Wireshark 4.6.7, which addresses the buffer overflow in the Z39.50 dissector.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, meaning no public exploits are known. It is inferred that the attack vector involves supplying a malicious Z39.50 packet or opening a crafted capture file that triggers the crash, leading to denial of service. The impact is the loss of availability of the Wireshark application or the user session that runs it.