Technical impact
The vulnerability arises from unchecked input used as a loop condition in Wireshark’s Microsoft Network Monitor file parser. When a malformed capture file is processed, the parser can enter an excessively long loop, consuming system resources and ultimately causing the application to become unresponsive. This results in a denial of service that can affect the availability of Wireshark on the affected machine. The weakness is identified as improper input validation (CWE-606).
Affected Systems
Wireshark Foundation’s Wireshark product, specifically versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, is susceptible. All installations of these versions that use the Microsoft Network Monitor file parser are impacted.
Risk and Exploitability
The CVSS score of 4.7 indicates a medium severity; the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local, requiring an attacker to provide a crafted .cap file to the Wireshark parser. Remote exploitation is not indicated, and no privilege escalation is involved. In normal operation, the risk is limited to local denial of service on the machine running Wireshark.
Debian DSA