Security readout for executives and security teams
Plain-English summary
CVE-2026-3201 is a denial-of-service issue in Wireshark’s USB HID protocol dissector. A crafted capture or traffic requiring user interaction could exhaust memory and crash or hang Wireshark. It affects Wireshark 4.6.0 through 4.6.3 and 4.4.0 through 4.4.13.
Executive priority
Treat this as a routine but timely desktop tooling update. The business risk is disruption to security analysis workflows, not broad enterprise compromise. Prioritize SOC and malware-analysis systems where untrusted packet captures are opened frequently.
Technical view
The issue is categorized as CWE-1325: improperly controlled sequential memory allocation. CVSS 3.1 is 4.7, with local attack vector, high complexity, no privileges required, user interaction required, and high availability impact only. Confidentiality and integrity impacts are not identified in the provided sources.
Likely exposure
Exposure is mainly analyst workstations, SOC systems, and lab environments running affected Wireshark versions and opening USB HID-related captures. Server-side exposure is unlikely unless Wireshark is used in automated analysis workflows.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. Exploitation requires user interaction and high complexity, according to the CVSS vector. The practical impact is application denial of service, not code execution or data theft based on available evidence.
Researcher notes
The public bundle identifies affected version ranges and CVSS details, but the linked GitLab issue requires permissions. Do not infer exploitability beyond denial of service. Validate against Wireshark’s advisory for exact fixed versions and any additional operational guidance.
Mitigation direction
- Identify Wireshark installations running 4.6.0-4.6.3 or 4.4.0-4.4.13.
- Move affected systems off vulnerable versions following the Wireshark security advisory.
- Limit opening untrusted capture files until affected installations are updated.
- Review automated capture-processing workflows for affected Wireshark components.
Validation and detection
- Check installed Wireshark versions across analyst endpoints and shared systems.
- Confirm whether USB HID dissector usage appears in relevant workflows.
- Verify updated systems are no longer in the affected version ranges.
- Document any exceptions and monitor Wireshark vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1325: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3201 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H13.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wireshark.org/security/wnpa-sec-2026-05.htmlCVE reference
- GitLab Issue #20972CVE reference · issue-tracking, permissions-required
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improperly Controlled Sequential Memory Allocation
Improperly Controlled Sequential Memory Allocation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.