A heap-based buffer overflow in the Wireshark SBC codec exposes users to potential remote code execution and denial of service attacks.

The vulnerability is a heap-based buffer overflow (CWE-122) within the SBC codec implementation, which can be triggered when processing malicious packet data. The vulnerability requires user interaction to open a malformed file or capture stream, but does not require authentication from the attacker.

The potential for remote code execution poses a severe risk to analysts and security teams who rely on Wireshark for network diagnostics. A successful exploit could lead to full system compromise, unauthorized access to sensitive network traffic data, and service disruption. With a CVSS score of 7.8, this vulnerability is classified as High severity, reflecting the significant impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade all installations of Wireshark to version 4.6.5 or 4.4.15 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor network traffic for unusual patterns or crashes associated with Wireshark instances, and verify the integrity of captured files before processing them in a production environment.

Compensating Controls: Ensure that Wireshark is run with the least privilege necessary, and avoid opening untrusted packet captures on systems that contain sensitive data or have high-level network access.

Public Exploit Available: Unknown

Given the potential for remote code execution, it is imperative that organizations prioritize the deployment of the updated Wireshark versions. Administrators should audit their environments to identify all instances of the application and ensure the patch is applied across all workstations and servers used for packet analysis.