Wireshark's USB HID protocol dissector allocates memory sequentially without proper control, leading to memory exhaustion when parsing large or malformed HID packets. An attacker who can supply such packets to Wireshark can trigger a crash, resulting in a denial of service that disrupts the utility’s availability. The weakness corresponds to CWE‑1325 (Improper Input Handling) and CWE‑770 (Maximum Resource Consumption).

Vulnerable releases include Wireshark 4.6.0 through 4.6.3 and 4.4.0 through 4.4.13, distributed by the Wireshark Foundation. No other versions or products are affected according to the CNA data.

With a CVSS score of 4.7 and an EPSS below 1 %, the current likelihood of exploitation is considered low, and the issue is not listed in CISA’s KEV catalog. However, the exploit requires the attacker to have the ability to inject crafted USB HID traffic into a running Wireshark instance; the attack vector is therefore presumably local. Once the malicious packets are processed, Wireshark will terminate, denying service to the user and potentially disrupting any monitoring processes that depend on it. Because the CVSS base score reflects only local impact, organizations running critical monitoring should still consider the vulnerability noteworthy.