The vulnerability is a reachable assertion in the frame protocol metadissector of Wireshark. When malformed data triggers the assertion, the program crashes, resulting in denial of service. This vulnerability is identified as CWE-617.

The flaw affects the Wireshark application produced by Wireshark Foundation. Version ranges 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are impacted. Users of the 4.6 series should upgrade to 4.6.9 or later. No official solution for the 4.4 series is documented in the CVE data.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the supply of a crafted capture file that Wireshark processes, implying that an attacker would need to either compromise a system running Wireshark or persuade a user to open a malicious file. This inference is drawn from the description of the reachable assertion triggered by malformed frames; the specific vector is not explicitly stated in the data.