Technical impact
The vulnerability is a NULL pointer dereference in the PEAK CAN TRC file parser in Wireshark versions 4.6.0–4.6.8. When Wireshark attempts to process a maliciously crafted PEAK CAN TRC file, the parser dereferences a NULL pointer, causing the application to crash. This results in a denial of service for the user session and potentially for the host if the crash affects critical services.
Affected Systems
Affected software is Wireshark by the Wireshark Foundation. Versions from 4.6.0 up to and including 4.6.8 are vulnerable. Users running Wireshark within this version range should be aware that they can be impacted if they open any PEAK CAN TRC files that are not trusted.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity, but the EPSS score is below 1%, suggesting low exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to deliver a malicious PEAK CAN TRC file, either locally or via network sharing, to trigger the crash. Because no authentication or privilege escalation is required, the impact is limited to the affected user or process but can interrupt network traffic analysis activities.
