CVE-2024-4854 is a medium severity denial of service in Wireshark, scored 6.4 by NVD. The MONGO and ZigBee TLV dissectors can loop forever. Wireshark fixed it in 4.2.5, 4.0.15 and 3.6.23, so upgrade to one of those or later.
What's affected
Wireshark's advisory wnpa-sec-2024-07, dated 15 May 2024, lists these affected and fixed versions:
- 4.2.0 to 4.2.4, fixed in 4.2.5
- 4.0.0 to 4.0.14, fixed in 4.0.15
- 3.6.0 to 3.6.22, fixed in 3.6.23
The NVD record also lists Fedora 39 and 40, which package Wireshark. Distribution packages may carry the fix under their own version string, so use your distribution's security notice to confirm.
Severity: NVD scores the issue 6.4 (medium). The Wireshark advisory text I retrieved gives no separate score, so there is no conflict to reconcile.
The class is CWE-835, loop with unreachable exit condition.
How to check if you're exposed
Check the version of every Wireshark or TShark install, including analyst laptops, lab VMs and capture appliances:
tshark --version | head -1
wireshark --version | head -1
On Debian or Ubuntu style systems, apt list --installed 2>/dev/null | grep -i wireshark shows the package version. On Fedora, use rpm -q wireshark.
Do not forget automation. A TShark process that parses captures in a pipeline or sandbox is as exposed as the GUI, and a hung process there may go unnoticed.
What to do now
- Inventory Wireshark and TShark installs.
- Upgrade to 4.2.5, 4.0.15, 3.6.23 or later, or take your distribution's patched package.
- Until then, avoid opening capture files from untrusted sources on a machine you depend on.
- Put time and CPU limits on any automated job that runs TShark, so a stuck dissector cannot hold a worker forever.
- Add Wireshark to the software inventory you scan, since analyst tools are often missed.
Why it matters
A dissector decodes protocol bytes into fields. When the loop that walks through type-length-value records fails to advance, the process spins and burns CPU. Per the advisory, the trigger is a malformed packet injected on the network or a crafted capture file that someone is convinced to open.
Wireshark states it is unaware of any active exploits, and the record does not mark this CVE as KEV. The impact is availability of the analyst tool, not code execution. Still, the people who run Wireshark are often investigating an incident, so a tool that hangs on hostile traffic is a poor thing to discover at that moment.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this lead to remote code execution?
The advisory describes excessive CPU use only. It does not describe code execution.
Do I need a malicious file, or is network traffic enough?
Either. The advisory says a malformed packet on the wire or a crafted capture file can trigger it.
Sources
Last reviewed: 19 October 2026.
