CVE-2026-7379: 
Wireshark vulnerability analysis and mitigation

CVE-2026-7379 is a memory leak vulnerability in Wireshark's sharkd daemon component that allows unauthenticated attackers to cause a denial of service through uncontrolled memory consumption. It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability was published on April 30, 2026, with patches available in versions 4.6.5 and 4.4.15. The CVSS v3.1 base score is 7.5 (High) per NVD's network-based scoring, while ENISA/EUVD rates it 5.5 (Medium) under a local attack vector assessment (GitHub Advisory, Wireshark Advisory).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), where sharkd fails to properly free allocated memory after processing JSON-RPC requests. An attacker can exploit this by sending repeated load commands via the JSON-RPC interface to sharkd, causing unbounded memory growth with each request. A proof-of-concept demonstrates the issue using a crafted sharkd_multiload.jsonl file containing multiple JSON-RPC load commands, reproducible with ASAN_OPTIONS=detect_leaks=1 /src/build-sharkd/run/sharkd - < /poc/sharkd_multiload.jsonl (Wireshark GitLab, GitHub Advisory).

Successful exploitation causes denial of service by exhausting system memory on the host running sharkd. There is no confidentiality or integrity impact — the vulnerability is limited to availability. An unauthenticated network attacker can repeatedly trigger the memory leak until the sharkd process or the host system becomes unresponsive, potentially affecting other services sharing the same host (GitHub Advisory, Wireshark Advisory).

A proof-of-concept exploit is publicly available on the Wireshark GitLab issue tracker, providing concrete reproduction steps. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.022% per GitHub Advisory), indicating a low probability of near-term exploitation (Wireshark GitLab, GitHub Advisory).

1. Identify target: Locate systems running sharkd in daemon/socket mode on affected Wireshark versions (4.4.0–4.4.14 or 4.6.0–4.6.4), typically listening on a Unix socket or TCP port.
2. Prepare payload: Create a sharkd_multiload.jsonl file containing a large number of JSON-RPC load commands, each referencing a valid or crafted capture file, e.g., {"jsonrpc":"2.0","id":1,"method":"load","params":{"file":"/path/to/capture.pcap"}}.
3. Send requests: Pipe the payload file to the sharkd process: sharkd - < sharkd_multiload.jsonl, or connect to the sharkd socket and send the commands repeatedly.
4. Trigger memory exhaustion: Each load command causes sharkd to allocate memory that is never freed; repeating this causes unbounded memory growth until the process or system runs out of memory and becomes unavailable (Wireshark GitLab).

• Process: sharkd process exhibiting continuously growing memory consumption (RSS/VSZ) over time without corresponding release, observable via top, htop, or ps aux.
• Logs: System logs (e.g., /var/log/syslog, /var/log/messages) showing OOM (Out of Memory) killer events targeting sharkd or related processes.
• Network: Unusual volume of JSON-RPC load requests to the sharkd socket or TCP listener from unexpected sources.
• File System: Presence of crafted .jsonl files containing repetitive load method calls in temporary or working directories associated with sharkd.

Upgrade Wireshark to version 4.6.5 or later (for the 4.6.x branch) or 4.4.15 or later (for the 4.4.x branch) to receive the fix (Wireshark Advisory, GitHub Advisory). If immediate patching is not feasible, restrict network or socket access to sharkd instances using firewall rules or Unix socket permissions, limiting access to trusted clients only. Monitor system memory usage on hosts running sharkd for anomalous growth as a compensating control.

Debian issued a security advisory (DSA) addressing this and other Wireshark vulnerabilities, and Kaspersky's threat intelligence portal (KLA91056) catalogued the issue. Tenable released Nessus detection plugins (IDs 311244, 313009, and 318251) for this vulnerability. Coverage has been largely routine, with no notable researcher commentary or significant social media discussion beyond standard vulnerability tracking (Tenable Nessus, Linux Security).