This vulnerability (CVE-2026-6522) affects the Wireshark network protocol analyzer in specific versions (4.6.0 to 4.6.4 and 4.4.0 to 4.4.14). The issue is an infinite loop caused by the RPKI-Router protocol dissector due to a loop with an unreachable exit condition (CWE-835). This flaw can be triggered to cause a denial of service by making Wireshark hang or become unresponsive when processing crafted packets. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability.

Successful exploitation results in denial of service by causing Wireshark to enter an infinite loop, making the application unresponsive. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires local access and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or malformed RPKI-Router protocol data in affected Wireshark versions. Monitor official Wireshark Foundation communications for updates and apply patches once released.