Listen to this Post
The vulnerability exists within the MEGACO (Media Gateway Control) protocol dissector in Wireshark. When processing a specially crafted packet, the dissector enters an infinite loop while attempting to parse certain protocol data units (PDUs). This occurs due to improper handling of specific message sequences or malformed transaction identifiers, causing a logical loop condition that the parser cannot escape. The dissector fails to implement a safe maximum iteration counter for a particular decoding routine. As a result, Wireshark consumes 100% of a single CPU core, becomes unresponsive, and must be forcibly terminated, leading to a denial-of-service condition. The attack can be triggered by loading a malicious packet capture file or by live traffic capture if the dissector is enabled.
Platform: Wireshark
Version: 4.6.0-4.6.1, 4.4.0-4.4.11
Vulnerability: Dissector Infinite Loop
Severity: High
date: 12/03/2025
Prediction: 12/17/2025
What Undercode Say:
Analytics
tshark -V -r malicious.pcap -Y megaco top -p $(pidof wireshark)
How Exploit:
Craft malicious MEGACO packet. Send via network. Or, create .pcap file. User opens file. Wireshark loops, hangs.
Protection from this CVE
Update to patched version. Disable MEGACO dissector. Use -o megaco.desegment:false. Apply workarounds.
Impact:
Denial of Service. Application Freeze. CPU Exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
