CVE-2026-7375: Wireshark UDS Protocol DoS Vulnerability

CVE-2026-7375 Overview

CVE-2026-7375 is a Denial of Service vulnerability in Wireshark's UDS (Unified Diagnostic Services) protocol dissector. The vulnerability exists in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, where a specially crafted packet can trigger an infinite loop in the UDS dissector, causing the application to become unresponsive and consume excessive CPU resources.

Critical Impact
A malicious actor can cause Wireshark to hang indefinitely by crafting a packet that triggers an infinite loop in the UDS protocol dissector, rendering the network analysis tool unusable and potentially disrupting security monitoring operations.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE CVE-2026-7375 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7375

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw resides in Wireshark's UDS protocol dissector, which is responsible for parsing and analyzing Unified Diagnostic Services protocol traffic commonly used in automotive networks for vehicle diagnostics.

When processing certain malformed or specially crafted UDS packets, the dissector enters a loop that lacks a proper exit condition, causing the application to become unresponsive. The attack requires local access with user interaction, meaning a victim must open or process a malicious capture file containing the crafted packets.

The vulnerability affects the availability of the system without impacting confidentiality or integrity, making it a pure denial of service condition.

Root Cause

The root cause is an improperly bounded loop in the UDS protocol dissector code. When parsing specific UDS protocol fields, the dissector fails to properly validate loop termination conditions, allowing malformed packet data to create a scenario where the loop never exits. This is a common vulnerability pattern in protocol parsers where boundary conditions or malformed inputs are not adequately handled.

Attack Vector

The attack requires local access where an attacker must convince a user to open a malicious packet capture file (pcap/pcapng) or analyze traffic containing the crafted UDS packets. The attack complexity is low once the victim processes the malicious input. No privileges are required by the attacker, but user interaction is necessary for exploitation.

An attacker could distribute malicious capture files via email, file sharing platforms, or inject crafted packets into network traffic that is being captured by a Wireshark instance. In automotive security research environments where UDS protocol analysis is common, this could be particularly disruptive.

For technical details on the infinite loop condition, refer to the GitLab Work Item #21225 and the Wireshark Security Advisory WNPA-SEC-2026-50.

Detection Methods for CVE-2026-7375

Indicators of Compromise

Wireshark processes consuming 100% CPU and becoming unresponsive during packet analysis
Application hang or freeze when opening specific capture files containing UDS protocol traffic
System resource exhaustion symptoms when processing automotive network captures

Detection Strategies

Monitor for Wireshark processes with abnormally high CPU utilization over extended periods
Implement file integrity monitoring for capture files from untrusted sources
Use sandboxed environments when analyzing capture files from unknown or untrusted origins

Monitoring Recommendations

Track Wireshark process behavior for CPU usage anomalies exceeding normal operational thresholds
Implement timeout mechanisms for packet analysis tasks in automated workflows
Alert on Wireshark instances that remain in running state beyond expected analysis duration

How to Mitigate CVE-2026-7375

Immediate Actions Required

Update Wireshark to a patched version beyond 4.6.4 (for 4.6.x branch) or beyond 4.4.14 (for 4.4.x branch)
Avoid opening capture files from untrusted or unknown sources until patched
Consider disabling the UDS protocol dissector if not required for your analysis tasks
Run Wireshark in a sandboxed or virtualized environment when analyzing untrusted captures

Patch Information

Wireshark has released security updates addressing this vulnerability. Users should update to the latest version available for their respective branch. Details are available in the Wireshark Security Advisory WNPA-SEC-2026-50. The specific fix details can be reviewed in GitLab Work Item #21225.

Workarounds

Disable the UDS protocol dissector via Analyze > Enabled Protocols and unchecking UDS
Use the command line option to disable specific dissectors when running tshark
Process untrusted capture files in isolated virtual machines or containers
Implement resource limits (CPU time, memory) on Wireshark processes in automated analysis pipelines

bash

# Disable UDS dissector via command line when using tshark
tshark -r capture.pcapng --disable-protocol uds

# Alternative: Create a disabled protocols file
echo "uds" >> ~/.config/wireshark/disabled_protos