CVE-2025-13674

Access of Uninitialized Pointer in Wireshark

5.5 MediumFix available

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Nov 26, 2025

What each source reports

CVE List Score used 5.5

Access of Uninitialized Pointer in Wireshark

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: CVE-2025-13674
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-824
Updated: 2026-11-02

EUVDEUVD-2025-199716 5.5

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: EUVD-2025-199716
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3v8x-9546-ch2g 5.5

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: GHSA-3v8x-9546-ch2g
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-824
Updated: 2026-11-02

NVD 5.5

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: CVE-2025-13674
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-824
Updated: 2026-11-02

OSV 5.5

Access of Uninitialized Pointer in Wireshark

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: CVE-2025-13674
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-824
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-13674 5.5

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: DEBIAN-CVE-2025-13674
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2025-13674 5.5

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: UBUNTU-CVE-2025-13674
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-71044 No score

CVE-2025-13674 affecting package wireshark 4.0.8-1

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: AZL-71044
Updated: 2026-11-02

OSVAZL-71048 No score

CVE-2025-13674 affecting package wireshark 4.4.7-2

BPv7 dissector crash in Wireshark 4.6.0 allows denial of service

Record: AZL-71048
Updated: 2026-11-05

OSVopenSUSE-SU-2025:15778-1 No score

libwireshark19-4.6.1-2.1 on GA media

These are all security issues fixed in the libwireshark19-4.6.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15778-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1169-1 No score

Security update for wireshark

This update for wireshark fixes the following issues:

Update Wireshark to version 4.6.4 (jsc#PED-15400).

CVE-2024-9780: ITS dissector crash (bsc#1231475).
CVE-2024-9781: AppleTalk and RELOAD Framing dissector crash (bsc#1231476).
CVE-2024-11595: Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (bsc#1233594).
CVE-2024-11596: Buffer Over-read in Wireshark (bsc#1233593).
CVE-2025-1492: Uncontrolled Recursion in Wireshark (bsc#1237414).
CVE-2025-5601: Column handling crashes in Wireshark allows denial of service (bsc#1244081).
CVE-2025-9817: NULL Pointer Dereference in ssh dissector (bsc#1249090).
CVE-2025-13499: a malformed packet can lead to a Kafka dissector crash (bsc#1254108).
CVE-2025-13674: injecting a malformed packet can cause a crash (bsc#1254262).
CVE-2025-13945: HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service (bsc#1254471).
CVE-2025-13946: MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service (bsc#1254472).
CVE-2026-0959: denial of service via IEEE 802.11 protocol dissector crash (bsc#1256734).
CVE-2026-0960: denial of Service via HTTP3 protocol dissector infinite loop (bsc#1256736).
CVE-2026-0961: denial of Service vulnerability in BLF file parser (bsc#1256738).
CVE-2026-0962: denial of Service via SOME/IP-SD protocol dissector crash (bsc#1256739).
CVE-2026-3201: missing limit checks in USB HID protocol dissector's parse_report_descriptor function can lead to memory exhaustion (bsc#1258907).
CVE-2026-3202: missing checks in NTS-KE protocol dissector can lead to crash (bsc#1258908).
CVE-2026-3203: missing length checks in the RF4CE Profile protocol dissector can lead to illegal memory access and crash (bsc#1258909).

Also libvirt was rebuilt against wireshark for the libvirt plugin.

Record: SUSE-SU-2026:1169-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wireshark` Azure Linux:2	through 4.0.8-1	None known
`wireshark` Azure Linux:3	through 4.4.7-2	None known
`wireshark` Debian:14	before 4.6.1-1, plus listed versions 4.4.7-14.4.8-0exp14.4.9-14.6.0-0exp14.6.0-14.6.0~rc1-0exp14.6.0~rc1-0exp2	4.6.1-1
`libvirt` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 18 CVEs	before 11.0.0-150700.4.19.1	11.0.0-150700.4.19.1
`wireshark` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 18 CVEs	before 4.6.4-150700.21.8.1	4.6.4-150700.21.8.1
`wireshark` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 18 CVEs	before 4.6.4-150700.21.8.1	4.6.4-150700.21.8.1
`libvirt` SUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 18 CVEs	before 11.0.0-150700.4.19.1	11.0.0-150700.4.19.1
`wireshark` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3	None known
`wireshark` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less 2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2	None known
`wireshark` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less 2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2	None known

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`wireshark` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2	None known
`wireshark` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 3.4.7-1~exp13.4.9-13.6.2-1ubuntu13.6.2-23.6.2-2ubuntu0.1~esm1	None known
`wireshark` Ubuntu:24.04:LTS	All versions, plus listed versions 4.0.8-14.0.10-14.0.11-14.2.0-14.2.2-14.2.2-1.1build14.2.2-1.1build24.2.2-1.1build3	None known
`wireshark` Ubuntu:25.10	All versions, plus listed versions 4.4.5-14.4.6-24.4.6-2build14.4.7-1	None known
`wireshark` Ubuntu:26.10	All versions, plus listed versions 4.6.4-14.6.6-14.6.6-24.6.6-2build1	None known
`wireshark` Ubuntu:26.04:LTS	All versions, plus listed versions 4.4.7-14.6.0-14.6.1-24.6.2-34.6.3-14.6.4-1	None known
`wireshark` openSUSE:Tumbleweed	before 4.6.1-2.1	4.6.1-2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13674 is a medium vulnerability (CVSS 5.5) in Wireshark, published November 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in wireshark 4.6.1-1.

References

Show 39 moreShow less