The vulnerability is a null pointer dereference in Wireshark’s Bluetooth BR/EDR FHS protocol dissector that causes the application to crash when parsing a crafted packet, resulting in a denial‑of‑service condition that forces the user to restart the program. The likely attack vector is local, as the exploit requires a user to open a capture file or run a live capture that contains the vulnerable data. No remote exploitation method is documented.

Wireshark Foundation’s Wireshark products from version 4.6.0 up to but not including 4.6.8, and from version 4.4.0 to 4.4.18 are susceptible to this flaw.

The CVSS score of 5.5 indicates moderate severity focused on availability, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of exploitation. Because the attack requires a crafted packet to be processed by the application, it is considered a local, user‑initiated attack with limited exposure to remote adversaries at present.