CVE-2024-8250

What it actually does

The NTLMSSP dissector in Wireshark crashes when processing malformed or injected packets, causing an application-level denial of service.

Why it matters to the business

Organizations relying on Wireshark for network troubleshooting or security analysis may experience sudden tool unavailability, delaying incident response or diagnostics; low exploit likelihood reduces urgency but widespread use of the tool increases exposure surface.

How an attack unfolds

An attacker crafts a malicious capture file or injects specially formatted NTLMSSP packets onto a network segment monitored by Wireshark; when the application dissects the traffic the dissector encounters an unhandled condition and terminates.

How to fix it

Update Wireshark to a build containing commit 99a85ec073f079eb642d8b0894b5225bd52bd913 or later stable releases that contain the fix; avoid opening untrusted capture files until patched.

How to confirm the fix worked

Confirm the installed Wireshark version includes the referenced commit; replay known-malformed NTLMSSP test captures in a lab environment and verify the application no longer crashes.

Typical attack path

1. Identify or create a network capture containing NTLMSSP traffic
2. Modify or inject malformed NTLMSSP structures into the capture
3. Deliver the crafted capture file to a target user or system running Wireshark
4. Trigger packet processing which invokes the vulnerable dissector
5. Observe application crash and loss of analysis capability

How to detect it

Review Wireshark crash reports and application logs for NTLMSSP dissector entries; correlate user-reported sudden exits while processing capture files containing NTLM authentication traffic.

• NTLMSSP dissector crash in Wireshark logs
• Process termination with stack trace referencing packet-ntlm.c

What your security team should do

• Apply the fixed commit or newer Wireshark release across all analyst workstations within standard change windows
• Restrict opening of capture files from untrusted sources until deployment completes
• Monitor EPSS and KEV status for any future increase in observed exploitation