This vulnerability, identified as CWE-476 (NULL Pointer Dereference), affects Wireshark versions 4.6.0 through 4.6.4. It occurs in the RTSP protocol dissector, where processing crafted RTSP packets can cause the application to dereference a NULL pointer, resulting in a crash. The CVSS 3.1 base score is 5.5 (medium severity), with an attack vector limited to local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and impacts only availability (A:H) without affecting confidentiality or integrity. The vulnerability is published but lacks an official fix or patch at this time. No exploits have been observed in the wild.

Successful exploitation causes a denial of service by crashing Wireshark when processing RTSP traffic. There is no impact on data confidentiality or integrity. The attack requires local access and user interaction, limiting the risk to users who open maliciously crafted RTSP packets within Wireshark.

Patch status is not yet confirmed — check the Wireshark Foundation advisory for current remediation guidance. Until a patch is available, avoid opening untrusted RTSP traffic in affected Wireshark versions (4.6.0 to 4.6.4). Monitor official Wireshark channels for updates and apply fixes promptly once released.