CVE-2022-3724 in Wireshark
Summary
by MITRE • 12/09/2022
Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified as CVE-2022-3724 represents a critical denial of service flaw within Wireshark's USB HID protocol dissector affecting versions 3.6.0 through 3.6.8 on Windows operating systems. This issue arises from improper handling of malformed USB HID protocol data structures during packet analysis, creating a scenario where maliciously crafted network traffic or capture files can trigger unexpected application termination. The vulnerability specifically impacts the dissector component responsible for interpreting Human Interface Device communications over USB protocols, which are commonly used for keyboards, mice, and other input peripherals in network monitoring scenarios.
The technical root cause of this vulnerability stems from inadequate input validation within the USB HID protocol parsing logic. When Wireshark encounters malformed USB HID data structures in captured packets or network traffic, the dissector fails to properly handle the unexpected data formats, leading to memory corruption or stack overflow conditions that ultimately result in application crash. This flaw operates at the protocol analysis layer of Wireshark's packet processing pipeline, where the dissector attempts to parse and display USB HID protocol information for network administrators and security professionals conducting traffic analysis. The vulnerability manifests as a buffer overread condition when processing specific USB HID descriptor formats, causing the application to access memory locations beyond the allocated buffer boundaries.
The operational impact of CVE-2022-3724 extends beyond simple application instability, potentially compromising network monitoring capabilities in enterprise environments where Wireshark serves as a critical diagnostic tool. Attackers can exploit this vulnerability through two primary vectors: packet injection attacks where malicious USB HID data is transmitted over networks, or by crafting specially formatted capture files that trigger the dissector crash when opened by Wireshark. This creates a significant risk for network security teams who rely on Wireshark for incident response and network troubleshooting activities, as the tool becomes unreliable for critical security operations. The vulnerability aligns with CWE-121, which addresses stack-based buffer overflow conditions, and represents a classic example of improper input validation in protocol analysis software.
From an adversarial perspective, this vulnerability enables attackers to perform denial of service attacks against systems running vulnerable versions of Wireshark, potentially disrupting network monitoring operations and security analysis workflows. The attack surface includes any environment where Wireshark is used for network traffic analysis, particularly in security operations centers where analysts regularly process network captures from various sources. The exploitability factor is relatively high since it requires only the ability to inject malicious traffic or provide a crafted capture file, making it accessible to attackers with basic network access privileges. Organizations using Wireshark for network security monitoring should consider this vulnerability as a potential threat vector that could be exploited to disable critical network diagnostic capabilities.
The recommended mitigation strategy involves immediate upgrading to Wireshark version 3.6.9 or later, which contains the necessary patches to address the USB HID protocol dissector flaw. Network administrators should also implement additional monitoring for suspicious network traffic patterns that might indicate exploitation attempts, particularly focusing on USB HID protocol communications. Organizations should consider implementing network segmentation and access controls to limit exposure to potentially malicious traffic, while maintaining regular updates to security tools and applications to prevent similar vulnerabilities from impacting operational security infrastructure. This vulnerability demonstrates the importance of maintaining up-to-date network analysis tools and implementing robust input validation practices in protocol parsing components. The remediation process should include thorough testing of updated versions in controlled environments before widespread deployment to ensure compatibility with existing network monitoring workflows and capture file formats.