Wireshark’s SSH protocol dissector contains a heap-based buffer overflow that causes the application to crash when processing malformed packets. The vulnerability can lead to a denial of service, leaving the user unable to analyze network traffic until Wireshark is restarted. This weakness is captured by CWE-122.

The flaw exists in Wireshark versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18, produced by the Wireshark Foundation. The issue is reported for all builds of the Wireshark client that include the SSH dissector and is included in the listed affected versions.

The CVSS score is 5.5, a moderate rating that indicates a non-critical but significant impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known active exploitation at this time. The likely attack vector is the delivery of crafted SSH packets to a running Wireshark instance; an attacker would need network access to the host where Wireshark is listening or local access to inject hostile packets into the capture stream. The vulnerability is remotely exploitable through traffic that reaches the program, but it remains most practical for attackers who can influence the content of packets analyzed by Wireshark.