Wireshark’s AMR‑NB codec contains a stack‑based buffer overflow that can be triggered by processing malicious AMR‑NB packets. The improper handling causes the application to crash, resulting in a denial of service. The weakness is classified as CWE‑121 and CWE‑237.

Wireshark Foundation’s Wireshark product is affected in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is 0.00017 (less than 1%), indicating a very low expected probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. An attacker can deliver a crafted AMR‑NB packet to Wireshark and cause the application to terminate. The likely attack vector is the transmission of malicious AMR‑NB packets to Wireshark, an inference drawn from the description. Based on the description, it is inferred that an attacker does not need privileges beyond the ability to run the software or supply the packet, so the impact is limited to availability of the Wireshark instance; there is no known privilege escalation or data disclosure risk.