A heap-based buffer overflow exists in the TLS protocol dissector of Wireshark versions 4.6.0 through 4.6.4. The flaw can cause a denial‑of‑service condition and, depending on the environment, may lead to arbitrary code execution. The weakness is identified as CWE‑122, indicating an unbounded buffer write on the heap.

Wireshark Foundation’s Wireshark application is impacted. Users running Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, or 4.6.4 are vulnerable; upgrading to 4.6.5 or later removes the issue.

The CVSS score is 8.8, reflecting high severity. No EPSS score is publicly available, so the exploitation probability cannot be quantified at present. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS indicates it should be treated with urgency. Based on the description, the likely attack vector is a malicious network capture or injection of crafted TLS traffic that Wireshark processes, which could trigger the overflow during a normal dissector run.