Wireshark’s LZ77 decompression routine contains an improper memory allocation that can be triggered by a crafted packet. When versions 4.6.0 through 4.6.4 or 4.4.0 through 4.4.14 process such a packet, the dissection engine crashes, resulting in a denial of service. The weakness is identified as CWE‑1325 and causes the Wireshark process to terminate without compromising confidentiality or integrity.

The issue impacts all deployments of Wireshark released by the Wireshark Foundation that fall within versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. This includes installations on Windows, macOS, and Linux platforms used for packet capture and analysis.

Wireshark rates the vulnerability with a CVSS score of 5.5, indicating moderate severity. No EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalog, so there is no known large‑scale exploitation at this time. An attacker can typically supply the malicious packet remotely through the network that the Wireshark instance is capturing, or locally via a replay of a crafted capture file. The primary risk is the availability impact, which can interrupt network monitoring and potentially lead to broader operational disruptions.