A critical heap-based buffer overflow vulnerability in Wireshark allows unauthenticated remote attackers to trigger a denial of service or achieve remote code execution.

This is a heap-based buffer overflow (CWE-122) within the TLS protocol dissector. The flaw can be triggered by an unauthenticated attacker providing a malformed packet, which may result in application crashes or unauthorized code execution.

The potential for remote code execution poses a severe risk to the integrity and confidentiality of systems running the affected version of Wireshark. With a CVSS score of 8.8, this vulnerability is classified as High severity and could be leveraged to gain unauthorized access to the underlying host system, leading to significant operational disruption or data compromise.

Immediate Action: Upgrade Wireshark to version 4.6.5 or higher immediately to resolve the vulnerable code path in the TLS dissector.

Proactive Monitoring: Monitor network traffic logs for unusually large or malformed TLS packets that may indicate an attempt to trigger the dissector overflow.

Compensating Controls: Restrict access to network analysis tools to authorized internal segments only and ensure that Wireshark is not run with elevated system privileges to limit the impact of a potential compromise.

Public Exploit Available: Unknown.

Given the potential for remote code execution and the severity of heap-based buffer overflows, organizations should treat this update with high urgency. Administrators must prioritize patching all instances of Wireshark 4.6.0 through 4.6.4 across their environments to prevent potential exploitation.