Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 contain a heap‑based buffer overflow in the iLBC audio codec, a weakness that can be triggered by a maliciously crafted packet. This flaw is classified as CWE‑122 and results in the application crashing when the codec processes the packet, providing an attacker an opportunity to cause a denial of service. The vulnerability does not give the attacker immediate code execution or privilege escalation, but it may allow repeated interruption of critical network analysis workflows.

The flaw affects the Wireshark Foundation product, Wireshark. Vulnerable versions are those listed above. Affected packages include Wireshark 4.6.0‑4.6.4 and 4.4.0‑4.4.14. Users running any of these releases on any supported operating system are at risk unless updated.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Although the exact attack vector is not explicit, it is inferred to involve sending a crafted packet to a Wireshark instance that processes the iLBC codec. No external remote code execution or persistence is disclosed; the impact is limited to service disruption of the Wireshark application. The risk is moderate but potentially disruptive for environments that rely on continuous packet capture and analysis.