CVE-2025-13674

This flaw is rated as moderate because its impact is limited to a denial-of-service crash within the Wireshark application and does not allow remote code execution, memory corruption leading to privilege escalation, or compromise of system integrity. The vulnerability arises from a use-after-free condition in the BPv7 dissector, which can be triggered only by processing a specially crafted packet capture (PCAP) or by receiving malformed traffic while actively capturing. In typical environments, Wireshark is used for offline analysis or run by knowledgeable users who already treat untrusted capture files cautiously, reducing real-world exploitability. Furthermore, the attacker cannot gain control over execution—only cause the application to terminate—making the security impact significantly lower than flaws that enable data exfiltration or arbitrary code execution. As a result, the issue fits the characteristics of a moderate DoS-oriented parser bug rather than an important or high-severity vulnerability.