This vulnerability is a heap-based buffer overflow in the Wireshark dissection engine. When Wireshark processes a malformed packet or capture file, it corrupts heap memory, causing Wireshark to crash and rendering the application unavailable. The weakness is identified as CWE-122, a classic heap-based buffer overflow, and also as CWE-120, a buffer copy without checking input size.

Affects Wireshark Foundation’s Wireshark product versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The impact is confined to the Wireshark instance that processes the input file or traffic.

The CVSS score of 3.1 indicates low severity with availability as the only affected asset. EPSS Score of 0.00174 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves feeding a crafted capture file or network traffic to Wireshark, which triggers a crash. This does not provide code execution or privilege escalation; it only causes a denial of service. The overall risk remains low, though it could interrupt network analysis activities in environments that rely on continuous Wireshark availability.