The vulnerability is a NULL pointer dereference in the IEEE 802.11 protocol dissector of Wireshark, classified as CWE‑476. A malicious packet or capture file that triggers the faulty dissector can cause Wireshark to crash, resulting in a denial‑of‑service condition for the user. The flaw does not appear to grant confidentiality or integrity compromise, but it can interrupt network analysis workflows or allow an attacker to use the crash as a vector for broader attacks in a more complex environment.

Wireshark Foundation’s Wireshark software, specifically versions 4.6.0 through 4.6.4, is affected. No other vendors or products are listed.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. Based on the description, the likely attack vector is the processing of a crafted packet or a malicious capture file; an attacker who can supply such a file to the victim’s Wireshark instance can trigger the crash. The mitigation – upgrading to version 4.6.5 or later – removes the defect and eliminates the risk.