A heap-based buffer overflow in the CSN.1 protocol dissector causes Wireshark to crash when parsing CSN.1 traffic, resulting in denial of service. The flaw affects the handling of packet data in memory and was demonstrated in versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. The impact is confined to disrupting the service of the Wireshark instance processing attacker‑crafted CSN.1 packets, and does not directly expose data or privilege escalation.

Wireshark Foundation Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are vulnerable. All newer releases (e.g., 4.6.9 and later) contain the fix. Systems running Wireshark on any platform that uses these versions should be considered at risk until patched.

The CVSS score of 4.7 indicates moderate impact, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further implying limited exploitation activity. The likely attack vector is remote, based on the fact that an attacker can craft CSN.1 packets that trigger the buffer overflow during normal packet capture. Because the vulnerability manifests as a crash, an attacker must be able to feed the application with malicious traffic, which is typically achievable in network positions where Wireshark processes untrusted traffic.