This vulnerability (CVE-2026-6868) involves a stack-based buffer overflow in the HTTP protocol dissector component of Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The flaw can be triggered to cause the application to crash, leading to denial of service. The CVSS 3.1 base score is 5.5, reflecting medium severity with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability. There is no vendor advisory or patch information available at this time.

Successful exploitation results in denial of service by crashing the Wireshark application. There is no impact on confidentiality or integrity. The attack requires local access and user interaction, limiting the attack surface. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted HTTP traffic captures in affected Wireshark versions. Monitor for vendor updates to apply patches once available.