A NULL pointer dereference occurs in Wireshark’s sharkd daemon in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, causing the daemon to crash and thereby interrupting packet capture or analysis services. This failure results in a denial of service to legitimate users of the daemon and any services that depend on it. The weakness exemplifies a classic null dereference (CWE‑476) and reaches a reachable assertion vulnerability (CWE‑617). Based on the description, it is inferred that an attacker could trigger the crash by sending specially crafted packets to the daemon, as the crash occurs during packet processing.

Wireshark Foundation’s Wireshark product, specifically the 4.6.0‑4.6.4 range and the 4.4.0‑4.4.14 range, is impacted when the sharkd service is in operation. Users running these vulnerable versions and exposing the daemon to network traffic are susceptible to the crash.

The CVSS score of 5.5 categorizes the issue as moderate. The EPSS score is < 1%, indicating a low likelihood of widespread exploitation. The vulnerability has been publicly disclosed and a patch has been issued. Attackers can likely trigger the crash by sending crafted packets to the sharkd service from a remote host; local exploitation would also suffice. The bug is not listed in CISA’s KEV catalog, suggesting no known active exploitation at the time of this analysis. Based on the description, it is inferred that the attacker’s vector is remote packet injection.