The vulnerability is a heap-based buffer overflow in the C12.22 protocol dissector of Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. A specially crafted packet can cause the application to crash, interrupting the capture process and effectively denying service. The flaw is an unchecked memory copy leading to an out-of-bounds write (CWE-122), coupled with insufficient input validation that allows erroneous data to be processed (CWE-617). As a consequence the attacker can cause a local denial of service but the flaw does not provide remote code execution or data disclosure.

Affected vendor and product are Wireshark Foundation: Wireshark. Versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 of the software are vulnerable.

The CVSS score of 8.1 indicates a high severity, with availability as the principal impact. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves an adversary delivering a malformed C12.22 packet to a Wireshark instance, either via network traffic captured by the user or via a local file that triggers the crash, resulting in a local denial of service rather than privilege escalation or compromise.