Technical impact
A use‑after‑free flaw in Wireshark’s ZigBee ZCL protocol dissector causes a crash when processing malicious packets. The crash terminates the application, leading to service interruption for users who open a crafted capture file. The weakness is a classic memory corruption issue (CWE‑416). The impact is confined to the Wireshark process; it does not provide remote code execution or data exfiltration. However, repeated crashes can degrade user productivity and cause denial of service for network analysis tasks.
Affected Systems
Wireshark Foundation’s Wireshark application versions 4.6.0 through 4.6.8 are affected. All platform builds of these releases are vulnerable until patched to 4.6.9 or later. Users running earlier branches are not impacted.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity. The EPSS estimate is below 1%, suggesting that exploitation is unlikely but still possible. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires an attacker to supply a crafted ZigBee packet to Wireshark, which the user may inadvertently open. This indicates a local‑user or local‑network attack surface, not a remote exploitation scenario. The risk to organizations equates to potential DoS during packet analysis, which may affect troubleshooting and response operations.
