CVE-2025-13946: Wireshark MEGACO Dissector DOS Vulnerability

CVE-2025-13946 Overview

CVE-2025-13946 is an infinite loop vulnerability in the MEGACO (Media Gateway Control) protocol dissector in Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.1 and 4.4.0 through 4.4.11. An attacker can trigger the condition by convincing a user to open a crafted capture file or read a malicious packet stream. Successful exploitation causes the Wireshark process to hang, resulting in denial of service. The issue is tracked as CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
Local denial of service through an infinite loop in the MEGACO dissector, requiring user interaction to open a malicious capture or packet trace.

Affected Products

Wireshark 4.6.0 through 4.6.1
Wireshark 4.4.0 through 4.4.11
MEGACO protocol dissector component (wireshark:wireshark)

Discovery Timeline

2025-12-03 - CVE-2025-13946 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13946

Vulnerability Analysis

The vulnerability resides in the MEGACO protocol dissector, which parses H.248/MEGACO signaling used to control media gateways in VoIP networks. When Wireshark processes a specifically crafted MEGACO message, the dissector enters a code path where its loop exit condition is never satisfied. The process consumes CPU indefinitely and stops producing usable output.

Exploitation requires the analyst to open a malicious .pcap or .pcapng file, load a live capture containing crafted MEGACO frames, or read the crafted stream from stdin. The impact is limited to availability of the Wireshark process. Confidentiality and integrity are not affected. Additional context is available in the Wireshark Security Advisory WNPA-SEC-2025-08 and GitLab Issue #20884.

Root Cause

The root cause is a loop within the MEGACO dissector that lacks a reachable exit condition when parsing certain malformed field structures. The parser fails to advance its offset or does not validate a termination condition, so iteration continues without progress. This matches the pattern described in CWE-835.

Attack Vector

The attack is local and requires user interaction. Typical delivery vectors include emailing a crafted capture file to an incident responder, hosting a malicious .pcapng for download, or seeding a shared packet-capture repository. Automated pipelines that invoke tshark on untrusted captures will also hang. No authentication or network access to a victim host is needed beyond delivering the file.

No public proof-of-concept is available in the referenced advisories. Analysts should review the upstream GitLab Issue #20884 for technical details on the malformed field trigger.

Detection Methods for CVE-2025-13946

Indicators of Compromise

Wireshark or tshark processes consuming sustained 100% CPU on a single core with no forward progress in the packet list
Unresponsive Wireshark GUI shortly after opening a capture file containing MEGACO (H.248) traffic
Automated capture-processing jobs timing out on files that include MEGACO frames

Detection Strategies

Inventory endpoints and analyst workstations running Wireshark 4.4.0–4.4.11 or 4.6.0–4.6.1 using software asset management data
Alert on long-running wireshark.exe or tshark processes exceeding CPU or wall-clock thresholds established from baseline analyst workflows
Scan file shares and mail gateways for .pcap and .pcapng attachments arriving from untrusted senders, and quarantine for review

Monitoring Recommendations

Enable process telemetry on analyst and SOC workstations to capture Wireshark command lines and parent-process context
Monitor SOAR and forensic automation pipelines that call tshark on ingested captures for job hangs and repeated timeouts
Track patch compliance for Wireshark on all hosts where packet analysis tooling is authorized

How to Mitigate CVE-2025-13946

Immediate Actions Required

Upgrade Wireshark to a fixed release published in WNPA-SEC-2025-08 on all analyst workstations and automation hosts
Do not open packet captures from untrusted sources on vulnerable Wireshark versions
Terminate any hung wireshark or tshark processes and preserve the offending capture for offline analysis on a patched host

Patch Information

The Wireshark Foundation addressed the infinite loop in the MEGACO dissector in the releases referenced by Wireshark Security Advisory WNPA-SEC-2025-08. Upgrade to a version later than 4.6.1 in the 4.6 branch or later than 4.4.11 in the 4.4 branch. Source and technical details are tracked in GitLab Issue #20884.

Workarounds

Disable the MEGACO dissector in Wireshark via Analyze → Enabled Protocols and unchecking MEGACO until the host is patched
Pre-filter captures with editcap to strip MEGACO traffic before opening files sourced from untrusted parties
Process untrusted captures inside disposable virtual machines or containers with CPU and time limits to contain hangs

bash

# Configuration example: disable the MEGACO dissector from the CLI
tshark -o "disabled_protos:megaco" -r suspect.pcapng