A heap-based buffer overflow vulnerability in Wireshark versions 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4 poses a significant risk of remote code execution and system denial of service.

This vulnerability is a heap-based buffer overflow (CWE-122) within the RDP protocol dissector. It can be triggered by an unauthenticated attacker who forces the application to process a maliciously crafted packet.

The vulnerability carries a CVSS score of 7.8, indicating a high level of severity. Successful exploitation allows for arbitrary code execution or a complete crash of the network analysis tool, which could lead to unauthorized system access, data exfiltration, or a significant loss of operational visibility for network security teams.

Immediate Action: Upgrade all instances of Wireshark to version 4.6.5 or later to resolve the underlying buffer overflow.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous memory usage patterns during packet capture sessions.

Compensating Controls: Restrict access to network segments where Wireshark is utilized, and ensure that packet capture files are only processed from trusted sources.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution, this vulnerability should be prioritized for remediation. IT administrators must ensure all Wireshark installations are updated to the patched versions immediately to prevent potential exploitation.