CVE-2025-13674
Description
A flaw in the BPv7 (Bundle Protocol v7) dissector in Wireshark 4.6.0 can cause the application to crash when processing certain malformed packets or trace files. The bug was discovered during internal fuzzing and occurs due to a use-after-free memory error triggered while decoding BPv7 elements.
Statement
This flaw is rated as moderate because its impact is limited to a denial-of-service crash within the Wireshark application and does not allow remote code execution, memory corruption leading to privilege escalation, or compromise of system integrity. The vulnerability arises from a use-after-free condition in the BPv7 dissector, which can be triggered only by processing a specially crafted packet capture (PCAP) or by receiving malformed traffic while actively capturing. In typical environments, Wireshark is used for offline analysis or run by knowledgeable users who already treat untrusted capture files cautiously, reducing real-world exploitability. Furthermore, the attacker cannot gain control over execution—only cause the application to terminate—making the security impact significantly lower than flaws that enable data exfiltration or arbitrary code execution. As a result, the issue fits the characteristics of a moderate DoS-oriented parser bug rather than an important or high-severity vulnerability.
Mitigation
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the uninitialized pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the uninitialized pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the uninitialized pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
