CVE-2009-0599: Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attack...

Security readout for executives and security teams

CVE-2009-0599 is a Wireshark file-parsing flaw. If a user opens a malicious NetScreen snoop capture file in Wireshark 0.99.7 through 1.0.5, the application can crash. The sources describe denial of service, not confirmed code execution or active exploitation. Exposure is most likely on legacy analyst workstations, servers, or appliances still running affected Wireshark or tshark packages and processing untrusted NetScreen snoop files. Modern deployments are unlikely exposed unless old vendor builds remain installed. Treat this as a legacy tooling hygiene issue unless affected versions are still in use. Prioritize remediation where security teams or automated pipelines process externally supplied capture files, because crashes can disrupt investigations and workflows. Mitigation focus: Upgrade Wireshark or distro packages beyond the affected 0.99.7 through 1.0.5 range.; Check Wireshark and operating-system vendor advisories for the applicable fixed package.; Avoid opening untrusted NetScreen snoop files on legacy Wireshark installations..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.