Wireshark’s FMP/NOTIFY protocol dissector crashes when parsing certain packets, leading to a denial‑of‑service of the application. The flaw is flagged as CWE‑606 and CWE‑1286, reflecting inadequate input validation and loop termination. The available data indicates that a crash occurs after processing malformed input, but the precise internal failure mechanism is not described in the CVE description.

All releases of Wireshark from version 4.4.0 through 4.4.16 and from 4.6.0 through 4.6.6 are affected. The vulnerability solely impacts the Wireshark application on the host that performs the dissection; network infrastructure or other system components remain unaffected.

The CVSS score is 5.5, indicating medium severity. The EPSS score is < 1%, which means a very low, although non‑zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the vulnerability requires supply of a crafted packet or capture file that contains malformed FMP/NOTIFY data to Wireshark. The likely attack vector is a local or remote file or network traffic manipulation that provides the attacker with the ability to provide such data. Attackers cannot gain elevated privileges or execute code; the impact is limited to the availability of the Wireshark application.