CVE-2025-1492: Uncontrolled Recursion in Wireshark

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-20 · updated 2026-06-17
Weakness: CWE-674

Description

Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file

Affected products

Wireshark Foundation Wireshark: from 4.2.0 through 4.2.10; from 4.4.0 through 4.4.3

References

https://gitlab.com/wireshark/wireshark/-/issues/20373
https://www.wireshark.org/security/wnpa-sec-2025-01.html

Get alerted when CVE-2025-1492 or the next vulnerability affects your stack