The vulnerability is an improperly controlled sequential memory allocation in Wireshark's zlib decompression component that can be triggered during packet dissection, causing an application crash and resulting in a denial of service. The weakness is a classic example of CWE‑1325, where an attacker can influence the memory allocation sequence to exhaust resources or corrupt memory. The issue also involves CWE‑409, indicating that uninitialized or improperly handled data may affect the allocation logic. Exploitation leads to an immediate service interruption if a user opens a maliciously crafted capture file.

This flaw affects Wireshark Foundation products running versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Any installations of those versions that may process external capture files are vulnerable.

The CVSS score of 5.5 indicates a medium severity issue, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low exploitation probability. The likely attack vector is the delivery of a malicious pcap file that a user opens with Wireshark; the attacker does not need privileged access beyond the ability to load the file into the application. Because the crash does not expose code execution, the impact is restricted to a loss of availability for the dissecting process.