CVE-2026-7375 Details

A denial-of-service vulnerability has been identified in the UDS protocol dissector of Wireshark. This issue, present in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, arises from a malformed UDS request frame that causes the dissection process to enter an infinite loop. The loop is triggered by an attacker-controlled byte that, when set to zero, creates a condition where the dissection offset does not advance, preventing the loop from terminating. This flaw exploits a lack of proper input validation, allowing for excessive CPU usage and application hangs, particularly in the Wireshark GUI and when using tshark, the command-line version of Wireshark.

Users can upgrade to Wireshark versions 4.6.5, 4.4.15 or later. If an immediate upgrade is not possible, the UDS dissector can be disabled in the Wireshark settings, untrusted pcap files should be avoided, and tshark can be run with a timeout to prevent hangs.