CVE-2024-4854

What it actually does

Infinite loop conditions in the MONGO and ZigBee TLV protocol dissectors cause Wireshark to hang indefinitely when processing specially crafted network packets or capture files.

Why it matters to the business

Network analysts lose access to the packet analysis tool until it is forcibly restarted, delaying troubleshooting, incident response, and security investigations that rely on Wireshark.

How an attack unfolds

An attacker creates a malicious capture file or injects crafted packets containing malformed MONGO or ZigBee TLV data; when the victim opens the file or captures the traffic in a vulnerable Wireshark version, the affected dissector enters an infinite loop and the application becomes unresponsive.

How to fix it

Upgrade to a build containing commit 4aa814ac25a18ea48d4002351ed45d4b245b0c08 or later; avoid opening untrusted capture files until updated.

How to confirm the fix worked

Confirm Wireshark reports a version built after commit 4aa814ac25a18ea48d4002351ed45d4b245b0c08; test by attempting to open a known-triggering capture file and verifying the application remains responsive.

Typical attack path

1. Attacker generates a capture file or network traffic containing malformed MONGO or ZigBee TLV structures
2. Victim opens the file or captures the traffic in an affected Wireshark release
3. Dissector logic enters an unterminated loop
4. Wireshark process consumes CPU and stops responding, requiring manual termination

How to detect it

Monitor for Wireshark processes that consume sustained high CPU without producing output or that terminate abruptly; review system logs for repeated launches of tshark or wireshark shortly after opening external capture files.

What your security team should do

• Immediately update all Wireshark installations to a build containing the referenced fix commit
• Configure Wireshark to open files in a restricted or sandboxed environment where possible
• Educate analysts to avoid loading capture files from untrusted sources until patches are applied