CVE-2026-19694

Wireshark versions 4.6.0 through 4.6.7 contain a heap-based buffer overflow (CWE-122) in the TTX Logger file parser, the component used to read TTX Logger capture files. The flaw is triggered when the parser processes a crafted or malformed TTX Logger file, and the CVSS vector (local attack vector, user interaction required) means an attacker needs a local user to open the malicious file. Successful exploitation crashes the application, producing a denial of service with no confidentiality or integrity impact. Anyone running Wireshark 4.6.0 through 4.6.7 is affected, especially users who open capture files obtained from untrusted sources. No in-the-wild exploitation is known: the issue is documented with a public PoC reference on the Wireshark GitLab tracker, EPSS is 0.1% (3rd percentile), and it is not in CISA KEV.

What to do: Check the installed Wireshark version and upgrade to a release newer than 4.6.7 when available from wireshark.org. As an interim mitigation, do not open TTX Logger capture files from untrusted or unexpected sources with affected 4.6.x builds; the flaw only causes a crash, so risk is limited to availability.