The vulnerability is a crash in the Wireshark MySQL protocol dissector caused by access of an uninitialized pointer, identified as CWE-824 and CWE-1286. When the dissector parses malicious MySQL traffic, it may terminate Wireshark, preventing further analysis and potentially disrupting network troubleshooting workflows. This loss of availability could affect a single user or a team that relies on Wireshark for monitoring and diagnostics.

Wireshark Foundation’s Wireshark product is affected. Versions 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 are vulnerable. All other releases are not impacted.

The vulnerability has a CVSS score of 5.5, indicating a moderate impact. An exploitation scenario requires Wireshark to process a crafted MySQL packet, so the attack vector is likely indirect, relying on an attacker to supply targeted traffic to a user’s Wireshark session. The EPSS score is < 1%, indicating a very low exploitation probability, but the lack of cataloguing in CISA KEV suggests limited current exploitation. The risk is present for systems that capture or open MySQL traffic without verification.