The vulnerability is a memory leak in the Wireshark daemon component known as sharkd. When processing certain network captures, memory allocations accumulate without proper deallocation, eventually exhausting system resources and causing the daemon to terminate. The failure to release allocated memory is a classic example of CWE-401, leading to a denial of service. The Affected packages run as a background service, so an attacker could potentially trigger the leak by manipulating packet streams or by simply running the service for an extended period. The data indicates that the leak leads to a crash or reboot of the process, thus interrupting traffic capture or analysis.

The affected systems are Wireshark Foundation Wireshark. The vulnerability exists in all releases of Wireshark 4.6.0 through 4.6.4 as well as 4.4.0 through 4.4.14.

CVSS score is 5.5, placing it in the medium severity class. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that widespread exploitation evidence is currently lacking. Nonetheless, because the flaw consumes heap memory indefinitely, an attacker who can maintain a persistent session with the daemon or force it to process crafted data could force the process to exhaust memory and crash. The likely attack vector therefore involves local or remote operation of the sharkd service, as the description does not specify a specific interface. In environments where the service is exposed to untrusted input, the risk is higher.