A heap‑based buffer overflow is triggered by the X11 protocol dissector in Wireshark when processing a specially crafted packet. The overflow causes Wireshark to crash, resulting in a denial of service. This flaw does not provide code execution or privilege escalation, as reflected by the associated CWE identifiers.

The vulnerability affects Wireshark Foundation’s Wireshark products, specifically versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. All more recent releases, including 4.6.9 and later, are fixed and not affected.

The CVSS score of 5.5 rates the flaw as medium severity, and the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog and no public exploits are known. The likely attack vector is via delivery of a malicious X11 packet to Wireshark, which can originate from a local user or from a remote source that can inject traffic into captures. Exploitation results only in application crashes, causing denial of service but not further compromise.