SecuriTricks - CVE-2026-3201

Description

USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

Product(s) Impacted

Vendor	Product	Versions
Wireshark	Wireshark	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1325

Improperly Controlled Sequential Memory Allocation

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	wireshark	wireshark	/	/	/	/	/	/	/	/
a	wireshark	wireshark	/	/	/	/	/	/	/	/

References

https://gitlab.com/wireshark/wireshark/-/issues/20972

https://www.wireshark.org/security/wnpa-sec-2026-05.html

CVSS Score

4.7 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: Feb. 25, 2026, 3:20 p.m.
Last Modified: Feb. 26, 2026, 2:49 p.m.

Status : Analyzed

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

[email protected]

CVE-2026-3201