CVE-2026-7375
UDS Protocol Dissector Infinite Loop in Wireshark
Publication date: 2026-04-30
Last updated on: 2026-05-01
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.15 (exc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7375 is a vulnerability in Wireshark's UDS (Unified Diagnostic Services) protocol dissector that causes an infinite loop when processing certain malformed packets.
Specifically, when a malformed UDS service 0x2C request frame with subfunction 0x02 is processed, the parsing offset does not advance due to zero lengths in memory address and size fields. This causes the dissect_uds_internal() function to loop indefinitely, consuming 100% CPU and hanging the application.
The flaw affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. Exploitation is straightforward by sending a crafted packet or opening a malicious packet trace file.
How can this vulnerability impact me? :
This vulnerability can cause Wireshark to hang or become unresponsive by consuming excessive CPU resources due to an infinite loop.
The impact includes denial of service in the Wireshark GUI, tshark command-line interface, and during live capture sessions, disrupting network analysis and automated workflows.
An attacker can exploit this by injecting a malformed packet into the network or tricking a user into opening a malicious packet trace file.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability manifests as an infinite loop in Wireshark's UDS protocol dissector when processing a malformed UDS service 0x2C request frame with specific subfunction and byte values. Detection involves monitoring Wireshark or tshark for excessive CPU usage or application hangs when analyzing network traffic or packet trace files.
Specifically, look for packets containing a UDS service 0x2C (DynamicallyDefineDataIdentifier) request with subfunction 0x02 (defineByMemoryAddress) where the addressAndLengthFormatIdentifier byte is set to 0x00, which causes the infinite loop.
While no explicit commands are provided, you can use tshark or Wireshark filters to isolate UDS service 0x2C packets and inspect the subfunction and addressAndLengthFormatIdentifier fields. Monitoring CPU usage during capture or analysis can also indicate exploitation.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Wireshark to versions 4.6.5 or 4.4.15 and later, where the vulnerability has been fixed.
Alternatively, you can disable the UDS dissector in Wireshark to prevent processing of the vulnerable protocol.
Avoid opening untrusted packet trace files that might contain maliciously crafted packets exploiting this vulnerability.
For automated workflows using tshark or similar tools, consider using timeout wrappers to prevent hangs caused by the infinite loop.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-7375 vulnerability causes a denial of service in Wireshark by triggering an infinite loop that consumes excessive CPU resources and hangs the application. This disruption can affect the availability and reliability of network traffic analysis and monitoring tools.
While the vulnerability itself does not directly expose sensitive data or compromise confidentiality or integrity, the denial of service impact could hinder timely detection and response to security incidents, potentially affecting compliance with standards like GDPR and HIPAA that require maintaining availability and security of systems processing personal or health data.
Mitigations such as upgrading Wireshark to fixed versions, disabling the vulnerable dissector, or avoiding untrusted files are recommended to maintain operational security and compliance.