The flaw is an out‑of‑bounds read in Wireshark’s Bluetooth Attribute Protocol dissector that causes the program to crash when parsing a crafted packet. The crash results in a denial of service, interrupting network analysis, but does not provide privilege escalation or arbitrary code execution. This weakness is represented by CWE‑125.

The issue affects Wireshark Foundation’s Wireshark application in releases 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18 on any supported platform. Users of any of those versions are vulnerable whenever the dissector processes a Bluetooth Attribute Protocol packet that triggers the out‑of‑bounds read. The vendor notes that the problem is fixed in version 4.6.8 and newer.

The CVSS score of 4.7 places the vulnerability in the low‑to‑moderate severity range. EPSS data is not available, and the CVE is not listed in the CISA KEV catalog. The likely attack vector involves providing a malicious packet to Wireshark, which can be a local or remote vector depending on the environment. The lack of exploit code execution limits the attacker's objectives to forcing application termination, but an unpatched system remains vulnerable to these service disruptions.