CVE-2025-13946
📋 TL;DR
A vulnerability in Wireshark's MEGACO dissector causes an infinite loop when processing specially crafted packets, leading to denial of service. This affects Wireshark users analyzing network traffic containing MEGACO/H.248 protocol data. The vulnerability can crash Wireshark or cause excessive CPU consumption.
💻 Affected Systems
- Wireshark
📦 What is this software?
Wireshark by Wireshark
Wireshark by Wireshark
⚠️ Risk & Real-World Impact
Worst Case
Wireshark crashes or becomes unresponsive, disrupting network analysis operations and potentially causing data loss of unsaved captures.
Likely Case
Wireshark process hangs or crashes when analyzing malicious MEGACO traffic, requiring restart and losing current capture session.
If Mitigated
Limited to Wireshark application impact only; no system-wide compromise or data exfiltration.
🎯 Exploit Status
Exploitation requires the target to be running Wireshark and capturing network traffic containing the malicious packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Wireshark 4.6.2 and 4.4.12
Vendor Advisory: https://www.wireshark.org/security/wnpa-sec-2025-08.html
Restart Required: Yes
Instructions:
1. Download latest Wireshark from wireshark.org. 2. Run installer (Windows) or use package manager (Linux). 3. Restart Wireshark after installation.
🔧 Temporary Workarounds
Disable MEGACO dissector
allPrevent Wireshark from processing MEGACO/H.248 protocol traffic
wireshark -o megaco.desegment:false
tshark -o megaco.desegment:false
Use capture filters
allFilter out MEGACO traffic during capture
wireshark -f "not port 2944"
tshark -f "not port 2944"
🧯 If You Can't Patch
- Restrict Wireshark usage to trusted networks only
- Monitor Wireshark process for abnormal CPU usage and restart if detected
🔍 How to Verify
Check if Vulnerable:
Check Wireshark version: Help → About Wireshark (GUI) or 'wireshark --version' (CLI). If version is 4.6.0-4.6.1 or 4.4.0-4.4.11, you are vulnerable.Check Version:
wireshark --version | head -1Verify Fix Applied:
Verify version is 4.6.2 or higher, or 4.4.12 or higher. Test with known MEGACO traffic to ensure no crashes.📡 Detection & Monitoring
Log Indicators:
- Wireshark crash logs
- Application event logs showing Wireshark termination
Network Indicators:
- MEGACO/H.248 protocol traffic to monitored networks
- Port 2944/TCP or 2944/UDP traffic
SIEM Query:
source="wireshark.log" AND ("crash" OR "segmentation fault" OR "infinite loop")