CVE-2024-9780

What it actually does

The vulnerability triggers a crash in the ITS protocol dissector when processing malformed or specially crafted network packets or capture files, resulting in denial of service.

Why it matters to the business

Network analysts and security teams lose the ability to inspect traffic with affected Wireshark versions, causing delays in troubleshooting, incident response, and forensic investigations until the application is restarted or upgraded.

How an attack unfolds

An attacker crafts a malicious packet or capture file targeting the ITS dissector and delivers it to a victim running the vulnerable Wireshark version, either by network injection or by sharing the file, causing an immediate crash and service interruption.

How to fix it

Upgrade Wireshark to the commit 575b2bf4746e29e35a99e50fbec0de9fcaa1155a or later; for the unrelated Vault component listed in affected products, upgrade to version 1.15.5 or later.

How to confirm the fix worked

Verify the installed Wireshark version is newer than 4.4.0 and confirm the presence of the fix commit; test by attempting to open a previously crashing capture file and confirm the application no longer terminates unexpectedly.

Typical attack path

1. Identify or create a capture file or live traffic containing a malformed ITS protocol payload
2. Deliver the crafted data to the target via file sharing, email, or direct network transmission
3. Trigger the ITS dissector in Wireshark 4.4.0 by opening the file or capturing the traffic
4. Cause the application to crash, denying service until restart

How to detect it

Review application crash logs and error reports for sudden Wireshark terminations while processing network captures; look for repeated restarts or core dumps associated with packet dissection activity.

What your security team should do

• Immediately upgrade all Wireshark installations to a fixed version
• Restrict opening of untrusted capture files until patches are applied
• Monitor EPSS and KEV status for any future changes in exploit availability