A null pointer dereference occurs in the RTSP protocol dissector of Wireshark versions 4.6.0 through 4.6.4, triggering a crash when the software attempts to process an RTSP packet. The flaw results in a denial of service by causing the Wireshark process to terminate unexpectedly, but it does not provide remote code execution or data exfiltration capabilities. The vulnerability is a classic null pointer dereference (CWE‑476) and also involves a use‑after‑free or similar condition (CWE‑617).

The vulnerability affects Wireshark software distributed by the Wireshark Foundation. All installations running versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, or 4.6.4 are impacted. Versions before 4.6.0 or 4.6.5 and later are not affected.

The CVSS score of 5.5 indicates a moderate impact. The EPSS score of less than 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the processing of malicious RTSP traffic; an attacker could craft a packet that Wireshark processes during a capture, causing the application to crash. Although no remote execution is possible, repeated crashes could deny service to users or interrupt critical monitoring workflows.