A parsing flaw in Wireshark 4.6.0 through 4.6.8 causes the TTL file parser to enter an infinite loop. The flaw can be triggered by feeding the application a specially crafted TTL file, which results in the process repeatedly executing the same code path and eventually exhausting system resources. The effect is a denial of service that prevents Wireshark from processing additional packets or responding to user input during the attack.

Wireshark Foundation’s Wireshark application is affected when the version is between 4.6.0 and 4.6.8 inclusive. The vulnerability is mitigated in version 4.6.9 and later. No other product versions are listed as affected.

The CVSS score of 5.5 indicates a moderate severity and the EPSS score of less than 1% demonstrates a very low exploitation probability in the current threat landscape. Because the flaw requires the attacker to supply a malicious TTL file, the likely attack vector is a local or remote file upload scenario where the malformed file is processed by Wireshark. The vulnerability is not listed in the CISA KEV catalog, and no patches or workarounds are publicly available beyond the official upgrade.