CVE-2023-6175 is a High severity flaw (CVSS 7.8) in the NetScreen file parser of Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18. Opening a malformed capture file can crash the application. The Wireshark project fixed it in 4.0.11 and 3.6.19, so upgrade to those releases or later.
What's affected
Wireshark's own advisory, wnpa-sec-2023-29, dated 15 November 2023, lists the following.
- Affected: Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18.
- Fixed: Wireshark 4.0.11 and 3.6.19.
The NVD record scores it 7.8 High with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means a local attack path that needs a user to open a file. The advisory credits an anonymous researcher working with Trend Micro's Zero Day Initiative.
Where the sources differ. The Wireshark advisory describes the impact as a crash: Wireshark can be made to crash by a malformed packet on the wire or by a malformed trace file. The upstream issue (number 19404) carries the ZDI report, which titles the bug a heap-based buffer overflow and labels it a remote code execution vulnerability. The NVD score of 7.8 assumes high impact on confidentiality, integrity and availability, which matches the ZDI framing rather than the crash-only wording. Treat it as at least a denial of service and plan for the higher rating.
How to check if you're exposed
Check the version on every machine where analysts open captures, including jump hosts and lab laptops.
wireshark --version
tshark --version
Anything from 4.0.0 to 4.0.10, or 3.6.0 to 3.6.18, is in range. Linux distributions often backport fixes without changing the upstream version number, so also check your distribution's security tracker for the package. Debian published LTS announcements for this CVE, listed in the NVD references.
If Wireshark ships inside a container image or a tooling bundle, scan the image rather than the host. The free in-browser dependency scan can also confirm whether a manifest pulls in a vulnerable build.
What to do now
- Upgrade Wireshark to 4.0.11, 3.6.19 or any later release, or install your distribution's patched package.
- Until you can upgrade, avoid opening NetScreen format capture files from sources you do not control.
- Treat capture files from customers, vendors and public sample sites as untrusted input, and open them in a disposable VM.
- Find analysis tools that bundle Wireshark libraries, such as forensic appliances, and ask their vendors for the patched build.
- Add Wireshark to your software inventory if it is missing, so the next dissector bug shows up in a search.
Why it matters
The weakness is classified as CWE-120, a buffer copy without checking the size of the input. The ZDI report in the upstream issue traces it to the code that reads hex dump lines in the NetScreen capture reader. The packet length comes from the file, a buffer is sized from it, and the loop that fills the buffer checks bounds too late. The report is the source for this description, and the project's advisory is deliberately brief.
Packet analyzers are an unusual attack surface. They parse hundreds of formats written by other people, and analysts open files they did not create, often with elevated privileges on a machine that sits near sensitive networks. A parser bug in a dissector or file reader is therefore worth patching even when the attack needs a click. The record's kev flag is false, and neither source describes exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2023-6175 need network access?
The NVD vector is local with user interaction. The victim has to open a crafted capture file, or Wireshark has to process a malformed packet, per the project's advisory.
Which release fixes it?
Wireshark 4.0.11 on the 4.0 branch and 3.6.19 on the 3.6 branch, according to wnpa-sec-2023-29.
Sources
Last reviewed: 19 October 2026.
