Wireshark Vulnerability Enables DoS Attack Through Malicious Packet Injection

Researchers have identified a serious vulnerability in Wireshark (CVE-2025-5601) that allows attackers to cause denial-of-service through malformed capture files or packet injection impacting millions who depend on the tool for network analysis.

Labeled wnpa-sec-2025-02, the flaw was disclosed by the Wireshark Foundation on June 4, 2025, and received a high severity classification with a CVSS score of 7.8.

The vulnerability impacts Wireshark versions 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12. It has been categorized under CWE-120, denoting a classic buffer overflow due to unchecked input size during buffer copying.

Buffer Overflow Bug in Wireshark Could Lead to DoS Attacks

Security analysts have identified two main ways the vulnerability can be exploited. Attackers may inject malformed packets into the network being analyzed by Wireshark, or they could lure users into opening malicious capture files designed to crash the application.

According to the Wireshark Foundation’s official advisory, the flaw was “identified during internal testing,” and there are currently “no known instances of exploitation in the wild.”

Despite this, cybersecurity experts caution that the risk remains high, especially considering Wireshark’s extensive use across corporate and enterprise environments.

If exploited, this flaw can cause Wireshark to unexpectedly terminate, interrupting essential network monitoring and diagnostic functions.

Such disruptions may have serious consequences for organizations that depend on Wireshark for real-time threat detection, incident response, and overall network visibility.

Patch Now: Wireshark Addresses Critical Vulnerability

To mitigate the risk, the Wireshark Foundation has released updates resolving the flaw. Users are strongly encouraged to upgrade to version 4.4.7 or 4.2.12, both of which include the necessary security fixes. These updates were made available on the same day the vulnerability was publicly disclosed—June 4, 2025.

In addition to applying patches, cybersecurity professionals recommend taking the following precautions:

• Open capture files only from trusted sources

• Restrict packet capture activity to secure, controlled environments

• Use network segmentation to isolate critical monitoring tools

  
  

This vulnerability adds to a growing list of issues involving Wireshark's dissector modules, following earlier security flaws such as CVE-2025-1492 and previously reported bugs in the Bluetooth ATT, Radiotap, and Bundle Protocol dissectors.

The incident highlights the ongoing complexity of securing tools like Wireshark, which must interpret potentially dangerous traffic from untrusted sources.

Organizations relying on Wireshark in operational environments should prioritize immediate updates and reassess their defensive measures to stay ahead of potential threats.