CVE-2025-13674: Wireshark BPv7 Dissector DOS Vulnerability

CVE-2025-13674 Overview

CVE-2025-13674 is a denial-of-service vulnerability in the Bundle Protocol version 7 (BPv7) dissector shipped with Wireshark 4.6.0. A malformed packet processed by the dissector triggers a crash in the analyzer process, terminating the session and interrupting network capture or analysis workflows. The flaw is tracked under [CWE-824: Access of Uninitialized Pointer] and requires user interaction, such as opening a crafted capture file or analyzing live traffic that contains the malformed BPv7 data.

Critical Impact
Attackers can crash Wireshark by delivering a crafted BPv7 packet or capture file, disrupting analyst workflows and incident response activities.

Affected Products

Wireshark 4.6.0
BPv7 protocol dissector component
Deployments using wireshark or tshark for live capture and offline analysis

Discovery Timeline

2025-11-26 - CVE-2025-13674 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13674

Vulnerability Analysis

The vulnerability resides in the BPv7 dissector, the Wireshark component responsible for parsing Delay-Tolerant Networking (DTN) Bundle Protocol version 7 traffic. When the dissector encounters a specifically malformed BPv7 packet, execution reaches a code path that accesses an uninitialized pointer, causing the process to crash. The impact is limited to availability: Wireshark terminates, but confidentiality and integrity of the host remain intact. Analysts running unattended captures or forensic reviews lose in-flight data and must restart the tool.

Root Cause

The issue is classified as [CWE-824: Access of Uninitialized Pointer]. The BPv7 dissector fails to validate or initialize a pointer field before dereferencing it while parsing structured bundle data. Malformed input reaches the vulnerable dereference without sanitization, producing an unrecoverable fault in the parsing thread. Refer to the Wireshark Security Advisory WNPA-SEC-2025-05 and GitLab Wireshark Issue #20770 for the maintainer's technical analysis.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted .pcap or .pcapng capture file containing a malformed BPv7 bundle, or injects the malformed packet into a network segment monitored by a Wireshark instance. When the analyst opens the file or the live capture reaches the dissector, Wireshark crashes. Because dissectors run in the main process, the crash impacts the entire analysis session. See the GitLab issue tracker entry for reproduction details.

Detection Methods for CVE-2025-13674

Indicators of Compromise

Unexpected termination of wireshark, tshark, or dumpcap processes while parsing BPv7 traffic
Capture files sourced from untrusted origins containing BPv7 bundles that fail to open
Crash reports or core dumps generated by Wireshark 4.6.0 referencing the BPv7 dissector

Detection Strategies

Inventory endpoints and analyst workstations running Wireshark 4.6.0 and flag those exposed to untrusted packet captures
Alert on process crash events for wireshark.exe and tshark.exe correlated with recent capture file access
Inspect capture files with a patched Wireshark build in an isolated environment before distributing them to analysts

Monitoring Recommendations

Enable operating system crash reporting and forward events to a centralized log platform for review
Track file provenance for capture files entering the SOC and require validation before analysis
Monitor for repeated crash-and-restart patterns on shared analysis hosts that may indicate malicious captures

How to Mitigate CVE-2025-13674

Immediate Actions Required

Upgrade Wireshark 4.6.0 to the fixed release documented in the Wireshark Security Advisory WNPA-SEC-2025-05
Avoid opening capture files received from untrusted sources on production analyst workstations
Isolate analysis of suspicious BPv7 traffic to sandboxed virtual machines

Patch Information

The Wireshark Foundation addressed the crash in the BPv7 dissector as part of advisory WNPA-SEC-2025-05. Administrators should upgrade to the patched release identified in the official security advisory and confirm deployment on all systems where Wireshark 4.6.0 is installed. The fix commit and issue history are tracked in GitLab Wireshark Issue #20770.

Workarounds

Disable the BPv7 dissector in Wireshark preferences under Analyze → Enabled Protocols if patching cannot occur immediately
Restrict analyst workstations from directly parsing captures containing DTN or BPv7 traffic until patched
Use tshark with a protocol disable flag to filter BPv7 processing during automated pipelines

bash

# Disable the BPv7 dissector at the command line as a temporary workaround
tshark --disable-protocol bpv7 -r suspicious_capture.pcapng