CVE-2026-96419 is a medium severity (CVSS 5.5 in the record) flaw in how Wireshark 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 import configuration profiles. A crafted profile can crash Wireshark or run code. The fixed versions are 4.6.9 and 4.4.19.
What's affected
Wireshark advisory wnpa-sec-2026-106 lists 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 as affected and 4.6.9 and 4.4.19 as fixed. The record's weakness is CWE-22, path traversal.
Where sources differ. The record scores it 5.5 medium, with a local vector that needs user interaction and an availability only impact. Wireshark's advisory is broader: it says importing a crafted configuration profile could crash Wireshark or execute arbitrary code, and it gives no numeric score. The upstream issue is about the path traversal check not applying on Windows builds. Use the advisory's description when you decide how seriously to take it.
The project says it is unaware of exploits. The attack needs the victim to import a malformed profile.
How to check if you're exposed
Check the Wireshark version on each machine where analysts import profiles.
wireshark -v
Any version from 4.6.0 to 4.6.8, or from 4.4.0 to 4.4.18, is affected. Then check where profiles come from. Shared profiles that arrive by email, chat or a downloads folder are the usual route. Profiles kept in a team repository you control are lower risk.
What to do now
- Upgrade to Wireshark 4.6.9 or 4.4.19 or later.
- Tell analysts not to import configuration profiles from unknown sources, such as a forum post or an unsolicited email.
- Review shared profile collections for files you did not author.
- Install updates on Windows workstations first, since the upstream report concerns Windows behavior.
- Keep Wireshark running as a normal user, not as an administrator.
Why it matters
Profile import accepts a bundle of files and unpacks them into the user's configuration area. When the unpack step does not confine paths to that area, a file can land somewhere else. CWE-22 is the name for that. A written file in a plugin folder is run on the next start, which is why the vendor mentions code execution.
The condition is that someone imports the profile. It is a social engineering route, not a network one, and that is why the record scores it medium. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Quick check
Can this be triggered from the network?
The advisory describes importing a crafted profile, which needs the user to do something. It is not described as a network attack.
Why is the record's score lower than the advisory's wording suggests?
The record uses a local vector with user interaction and availability impact only. The advisory adds that code execution may be possible. Both are stated here.
Sources
Last reviewed: 18 October 2026.
