An infinite loop has been discovered in the SMB2 protocol dissector of Wireshark, leading to a denial of service. The unbounded loop is a classic example of CWE‑835, which can consume CPU resources and freeze the application precisely when the dissector processes a malicious SMB2 packet or an overly large payload. According to the official description, exploiting this flaw causes Wireshark to become unresponsive and can make the tool unusable for users needing to analyze network traffic.

The vulnerability affects the Wireshark application provided by the Wireshark Foundation. Version ranges impacted are 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, while all newer releases are considered fixed.

The CVSS score of 5.5 indicates moderate severity, and the absence of an EPSS score and of a KEV listing suggests that exploitation is not heavily observed or reported. Attackers can trigger the fault by feeding Wireshark with a crafted SMB2 message, either as part of a live capture or by loading a malicious capture file. This attack vector is inferred from the fact that the bug resides in the packet dissector; therefore, the flaw can be triggered via network traffic or any file Wireshark processes. The resulting denial of service can affect individual users or interrupt service for teams relying on Wireshark for network troubleshooting.