An infinite loop occurs in Wireshark’s TIFF protocol dissector between versions 4.6.0 and 4.6.8 and between 4.4.0 and 4.4.18. The flaw arises when the dissector processes a specially crafted TIFF file, causing it to loop indefinitely. The resulting denial of service is limited to the instance of Wireshark that is parsing the malformed file, potentially freezing the application and preventing further capture processing. This weakness corresponds to CWE‑835, which highlights unsafe loop conditions that can be exploited to exhaust CPU or cause a crash.

Wireshark in the Wireshark Foundation stack is affected. This includes the TCP‑dump, graphical, and command‑line versions. Affected release ranges are 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18; the fix is included in 4.6.9 and later. Versions prior to 4.4.0 and beyond 4.6.8 are not impacted by this specific loop.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker must supply a malicious TIFF file to the Wireshark instance, typically by opening a crafted .tif packet capture or capturing traffic that contains the TIFF record. Because the loop is an infinite one, the only effect is that Wireshark becomes unresponsive, which can be used to perform a denial‑of‑service against a single user or to interfere with a forensic or monitoring workflow. No privilege escalation or data exposure is associated with the flaw.