Description

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T23:16:20.107Z",
  "pubdate": "2026-08-19T23:16:20.107Z",
  "executiveSummary": "A denial of service vulnerability exists within the sharkd component of Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The flaw allows an unauthenticated remote or local attacker to trigger a crash in the affected software, leading to a complete disruption of service for the daemon process. This vulnerability stems from improper handling of specific inputs or control flows within sharkd, which parses packet analysis requests. Successful exploitation results in the abrupt termination of the daemon, denying service to legitimate clients relying on the analysis interface. The risk implication is moderate to high depending on the deployment exposure of the sharkd service, as repeated crashes can consistently degrade service availability. No specific exploitation requirements beyond reaching the vulnerable sharkd listening interface are detailed in the crash report.",
  "technicalDetails": "The vulnerability resides within the sharkd component, which acts as a socket-based daemon for Wireshark, providing a JSON-RPC-like interface to analyze packet capture data. The root cause involves an unchecked condition, memory mismanagement, or parsing failure when processing malformed or specifically crafted requests submitted to the service. When sharkd encounters this anomalous input, it triggers an unhandled exception or assertion failure, causing the process to abort execution immediately.\nThe attack flow begins when an attacker establishes communication with the vulnerable sharkd instance, typically over a network socket or UNIX domain socket depending on the daemon configuration. The attacker transmits a maliciously crafted command payload designed to trigger the vulnerable parsing or processing routine within the sharkd codebase. Upon receiving and parsing the payload, the internal functions fail to validate structural boundaries or state conditions correctly, resulting in an abnormal program termination and subsequent denial of service.\nAffected software versions include Wireshark sharkd 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The vulnerability does not require prior authentication or elevated privileges, as long as the attacker can establish a network or local connection to the sharkd service port. The post-exploitation impact is strictly limited to availability, causing service disruption without granting remote code execution or unauthorized data access based on the crash description."
}