The vulnerability is an uncontrolled recursion in the ASN.1 PER protocol dissector in Wireshark, which leads to a crash when processing certain malformed or specially crafted capture files, resulting in a denial of service. The weakness is classified as CWE-674, reflecting uncontrolled recursion or stack exhaustion.

Wireshark Foundation's Wireshark software is affected. Versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 contain the flaw. All installations of these versions run the vulnerable dissector and should be updated or discontinued until a patch is applied.

The flaw carries a CVSS score of 5.5, indicating moderate severity. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The most likely attack vector is a local attacker who can open a crafted capture file using Wireshark. By manipulating ASN.1 PER messages, the attacker can trigger the recursion and force the application to crash, causing a denial of service on the host running Wireshark. Because the attack requires local file access and does not involve remote code execution, the risk is contained to the device that runs the application, but it can disrupt critical network analysis workflows.