CVE-2026-96419

Wireshark is a tool used to inspect network traffic, often by IT staff troubleshooting connectivity or security issues. This flaw is like a mislabeled file that, when opened, can sneak outside its intended folder and damage the program or let an attacker run their own instructions on that computer. The risk only appears if someone opens a malicious profile file someone else sent them.

This matters to you if your IT staff or any employee uses Wireshark for network diagnostics or security monitoring. It only becomes a risk if that user is tricked into importing a specially crafted profile file from an untrusted source.

This is rated as urgent to address: although there is no confirmed active exploitation in the wild yet and no public exploit code exists, the flaw can lead to code execution on the affected machine, and a fix is already available, so there is no reason to delay patching. Treat this as something to fix now rather than wait for an incident.

Confirm exposure by inventorying all systems running Wireshark 4.6.0–4.6.8 or 4.4.0–4.4.18. Upgrade affected installations to 4.6.9 (6.x branch) or 4.4.19 (4.4.x branch) or later — both are the vendor-designated fixed releases for this issue. There is no documented breaking-change concern for this patch. As a temporary workaround while patching is scheduled, instruct users not to import Wireshark profile files received from untrusted or unverified sources, since user interaction is required to trigger the flaw. No CISA KEV listing exists, so there is no federal remediation deadline. Monitor for unexpected Wireshark crashes tied to profile imports and watch vendor/security advisories for any shift from PoC-free status to active exploitation.

CVSS 3.1 score is 5.5 (Medium), vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — local attack vector, no privileges required, but user interaction required, with impact limited to availability (per the vector) though the underlying description notes possible code execution. Weakness class is CWE-22 (Path Traversal) triggered via unsanitized path handling during Wireshark profile import. Not listed in CISA KEV, no public exploit code, and no dated press claims of exploitation. EPSS places exploitation likelihood in the lowest percentile with a flat trend, consistent with a low-maturity, no-known-exploit status. Press attention is rising only as part of a broader vulnerability roundup, unrelated to confirmed exploitation of this specific CVE.