The flaw rests in Wireshark’s ICMPv6 "PvD" protocol dissector, where uncontrolled recursion can occur during packet parsing. This causes Wireshark to crash, leading to a service interruption. Because the vulnerability is triggered by malformed protocol data, it results in a denial of service rather than an attacker gaining further privileges.

The issue affects Wireshark Foundation releases 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Any user running those versions is potentially impacted.

With a CVSS score of 5.5, the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting that while exploitation is feasible, it may not be widely targeted. Attackers would need to supply crafted ICMPv6 PvD packets—either over the network or via a malicious packet capture file—to trigger the crash, so the likelihood of exploitation is confined to environments where the attacker can influence the traffic seen by Wireshark or the files it loads.