Wireshark’s pcapng file parser contains a heap‑based buffer overflow that can be triggered by a specially crafted file. When the overflow occurs, the application crashes, which results in a service interruption. The weakness is identified as CWE‑122 and represents a classic input‑validation flaw that compromises application availability.

The vulnerability affects Wireshark Foundation’s Wireshark software, specifically releases 4.6.0 through 4.6.6.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation is very low, and the vulnerability is not listed in CISA KEV, indicating it is not known to be actively exploited. The likely attack vector is the receipt or opening of a malicious pcapng file by a user of Wireshark; an attacker must deliver the crafted file and have it parsed, and the impact is limited to availability rather than confidentiality or integrity.