Compliance Impact

The CVE-2026-7375 vulnerability causes a denial of service in Wireshark by triggering an infinite loop that consumes excessive CPU resources and hangs the application. This disruption can affect the availability and reliability of network traffic analysis and monitoring tools.

While the vulnerability itself does not directly expose sensitive data or compromise confidentiality or integrity, the denial of service impact could hinder timely detection and response to security incidents, potentially affecting compliance with standards like GDPR and HIPAA that require maintaining availability and security of systems processing personal or health data.

Mitigations such as upgrading Wireshark to fixed versions, disabling the vulnerable dissector, or avoiding untrusted files are recommended to maintain operational security and compliance.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-7375 is a vulnerability in Wireshark's UDS (Unified Diagnostic Services) protocol dissector that causes an infinite loop when processing certain malformed packets.

Specifically, when a malformed UDS service 0x2C request frame with subfunction 0x02 is processed, the parsing offset does not advance due to zero lengths in memory address and size fields. This causes the dissect_uds_internal() function to loop indefinitely, consuming 100% CPU and hanging the application.

The flaw affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. Exploitation is straightforward by sending a crafted packet or opening a malicious packet trace file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to hang or become unresponsive by consuming excessive CPU resources due to an infinite loop.

The impact includes denial of service in the Wireshark GUI, tshark command-line interface, and during live capture sessions, disrupting network analysis and automated workflows.

An attacker can exploit this by injecting a malformed packet into the network or tricking a user into opening a malicious packet trace file.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability manifests as an infinite loop in Wireshark's UDS protocol dissector when processing a malformed UDS service 0x2C request frame with specific subfunction and byte values. Detection involves monitoring Wireshark or tshark for excessive CPU usage or application hangs when analyzing network traffic or packet trace files.

Specifically, look for packets containing a UDS service 0x2C (DynamicallyDefineDataIdentifier) request with subfunction 0x02 (defineByMemoryAddress) where the addressAndLengthFormatIdentifier byte is set to 0x00, which causes the infinite loop.

While no explicit commands are provided, you can use tshark or Wireshark filters to isolate UDS service 0x2C packets and inspect the subfunction and addressAndLengthFormatIdentifier fields. Monitoring CPU usage during capture or analysis can also indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Wireshark to versions 4.6.5 or 4.4.15 and later, where the vulnerability has been fixed.

Alternatively, you can disable the UDS dissector in Wireshark to prevent processing of the vulnerable protocol.

Avoid opening untrusted packet trace files that might contain maliciously crafted packets exploiting this vulnerability.

For automated workflows using tshark or similar tools, consider using timeout wrappers to prevent hangs caused by the infinite loop.

Useful 0 Not Useful 0