A heap-based buffer overflow occurs in the RF4CE protocol dissector of Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. The flaw allows an attacker to crash Wireshark, causing a denial of service and terminating the capture session. This weakness is classified as CWE‑122 and CWE‑476, indicating a memory corruption issue and a potential null pointer dereference. The impact is limited to the local machine running the affected Wireshark instance, as the attacker must supply or be able to open a crafted packet capture that triggers the dissector.

The vulnerability exists in Wireshark Foundation’s Wireshark product. Versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are affected. Any deployment of these releases that processes RF4CE protocol traffic is potentially vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not included in CISA’s KEV catalog, suggesting no widely available exploit stock. The likely attack vector is local, requiring the attacker to supply a malicious RF4CE packet capture file that an end user opens in Wireshark. If Wireshark processes such a file, the buffer overflow triggers a crash, leading to a denial of service.