A flaw in Wireshark’s USB HID protocol dissector can cause the application to enter an infinite loop, consuming CPU resources and ultimately freezing the tool. This is a classic example of CWE‑835 where an execution path never terminates. The vulnerability results in a denial of service that affects only the running instance of Wireshark and does not directly expose data or allow further compromise.

Wireshark Foundation’s Wireshark software is affected. The vulnerability exists in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, meaning any machine running those releases and parsing USB HID traffic is at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, implying no widespread exploitation has been reported to date. However, the attack is likely carried out by feeding crafted USB HID packets through a malicious device or captured traffic to an instance of Wireshark. Because the flaw operates at the application level, local execution of Wireshark with a USB HID device is sufficient to trigger the endless loop; elevated privileges are not required.