CVE-2026-96419

Executive Summary

CVE-2026-96419 is a path traversal (CWE-22) vulnerability affecting the profile import functionality of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker who can convince a user to import a crafted profile file can trigger a denial of service condition, with the possibility of code execution in the context of the user running Wireshark. The vulnerability requires local access and user interaction, yielding a CVSS v3.1 base score of 5.5 (Medium), and a public proof-of-concept is noted to exist.

Technical Analysis

Wireshark is a widely deployed network protocol analyzer used by network engineers, security analysts, and incident responders on Windows, Linux, and macOS workstations. The vulnerability resides in the profile import feature, which allows users to load a saved configuration profile (containing preferences, coloring rules, and related configuration data) into the application.

CVE-2026-96419 is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal). The NVD description states: "Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution." This indicates that when a profile archive is imported, path handling within the import routine lacks adequate restriction of the paths contained in the supplied profile data.

The attack surface is the profile import workflow: an operator opens or imports a profile package supplied by a third party (for example, a shared capture-analysis profile, a project artifact, or a file received via email or chat). Because the path traversal class allows a crafted path to escape its intended directory context, importing a maliciously constructed profile can cause the application to process data outside the expected location. In the observed impact, this results in an application crash (denial of service). The description additionally notes "possible code execution," implying that in some conditions the traversal could be leveraged for more severe impact than a pure crash.

No precise function names, class names, internal file paths, or archive-entry handling routines are disclosed in the NVD description or CNA title, so the exact internal mechanism (for example, which import handler resolves the archive entries) cannot be derived from the provided data. What is known at the vulnerability-class level is that path traversal in an import/parsing component permits untrusted path data to influence filesystem operations, and the resulting crash indicates a reachable memory-safety or error-handling fault in the import code path.

Exploitation prerequisites are significant: the vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H — local attack vector, low attack complexity, no privileges required, but user interaction is required. The confidentiality and integrity impacts are None; the availability impact is High, consistent with a crash-based denial of service. Scope is Unchanged.

Exploitation Scenarios

The attack chain for CVE-2026-96419 is social-engineering driven and follows the profile-import workflow. No public PoC code was supplied in the provided data beyond the "Public" PoC status indicator; the steps below are inferred from the vulnerability class (CWE-22) and the documented impact.

1. Reconnaissance / target identification. The attacker identifies a target who uses Wireshark 4.6.0–4.6.8 or 4.4.0–4.4.18. Because exploitation requires local interaction, the attacker must have a delivery channel to the victim (email attachment, shared drive, chat, or a repository of "useful" capture profiles) and must be able to convince the victim to import the supplied profile.

2. Triggering the path traversal. The attacker crafts a profile package containing path data that is not confined to the intended import directory. When the victim invokes Wireshark's profile import function on that package, the application processes the crafted paths in violation of the intended directory restriction (CWE-22). This is the traversal trigger; the specific archive entry names and internal resolver routines are not disclosed in the provided description and are not invented here.

3. Payload / execution method. At the vulnerability-class level, the attacker supplies malicious content via the traversed path rather than via any exotic input channel. Wireshark's import handling then operates on that content, which results in a crash (denial of service). The NVD description leaves open the possibility that the same defect can be leveraged toward code execution; because no code-level detail is provided, the precise mechanism by which code execution would be achieved cannot be confirmed from this data.

4. Post-exploitation impact. The immediate, documented effect is loss of availability: Wireshark terminates unexpectedly, disrupting an analyst's capture session and potentially losing unsaved captured data. If the "possible code execution" condition is realizable, the attacker could execute code with the privileges of the Wireshark process — which in many analyst environments runs as a normal user but may run with elevated privileges where capture permissions require it.

Risk factors: the PoC status is "Public," which lowers the effort required for an attacker to reproduce the crash. EPSS is 0.00194 (8.3rd percentile), indicating that near-term exploitation activity is expected to be low, consistent with a client-side tool that requires local user interaction rather than a remotely reachable service. CISA KEV status is NO, and no known in-the-wild campaigns are documented in the provided data.

Impact Assessment

Business impact. For most organizations, the primary impact is availability of a security analysis tool rather than enterprise-wide service disruption. An analyst whose Wireshark instance crashes mid-investigation may lose unsaved capture state, delay incident response, and be forced to restart analysis. In environments where Wireshark is used as part of continuous monitoring or on dedicated capture appliances, repeated crashes can degrade monitoring coverage.

Affected systems. All installations of Wireshark 4.6.0–4.6.8 and 4.4.0–4.4.18, on Windows, Linux, and macOS, are potentially affected when a user imports a profile. Systems that do not accept profiles from untrusted sources are at substantially reduced risk.

Blast radius. The local attack vector (AV:L) and required user interaction (UI:R) limit the blast radius to the individual endpoint and user session where the import occurs. Scope is Unchanged (S:U), meaning the vulnerability does not inherently cross security boundaries. Confidentiality and integrity impacts are None, while availability impact is High (A:H), producing the base score of 5.5 (Medium). The theoretical "possible code execution" noted in the description is the principal reason not to treat this purely as a nuisance crash: if realized, the impact could extend to the confidentiality and integrity of data accessible to the user's session, though the CVSS vector as published does not score those impacts.

Exposure considerations. Wireshark is client software, not a network service, so Shodan-type internet exposure is limited to unusual deployments (for example, Wireshark exposed via remote desktop or a web front end). Consequently, vulnerability management programs should focus on endpoint inventory, version compliance, and user awareness rather than internet-facing scanning.

Detection Guidance

Sigma Rule

title: Suspicious Wireshark Profile Import Activity (CVE-2026-96419)
id: 3f9c1b42-7a1d-4e88-9c2b-96419cve0001
status: experimental
description: Detects Wireshark process activity consistent with importing a profile, which is the trigger surface for CVE-2026-96419 (path traversal in profile import leading to DoS / possible code execution).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96419
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\Wireshark.exe'
  selection_cli:
    CommandLine|contains:
      - '-profile'
      - '--profile'
      - 'import'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate user importing a trusted, organization-approved profile
level: low

YARA Rule

rule CVE_2026_96419_Wireshark_Profile_PathTraversal
{
    meta:
        description = "Heuristic detection for Wireshark profile packages attempting path traversal (CVE-2026-96419)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96419"
        cwe = "CWE-22"
        severity = "medium"

    strings:
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "%2e%2e%2f" ascii nocase
        $traversal4 = "%2e%2e%5c" ascii nocase
        $wireshark = "wireshark" ascii nocase
        $profile   = "profile" ascii nocase

    condition:
        uint32(0) == 0x04034b50 and
        (any of ($traversal*)) and
        any of ($wireshark, $profile)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96419 Wireshark Profile Import Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"..%2f"; nocase; http.uri; content:"profile"; nocase; reference:cve,2026-96419; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96419; classtype:attempted-user; sid:202696419; rev:1;)

Note: Wireshark is a desktop client, so network IDS coverage is best applied to delivery channels (HTTP file retrieval) rather than exploitation of the client itself.

Elastic Detection

process where process.name : ("wireshark.exe", "Wireshark.exe") and
  process.command_line : ("*-profile*", "*--profile*", "*import*")

Splunk SPL Query

index=endpoint OR index=sysmon EventCode=1
| search (Image="*\\Wireshark.exe" OR Image="*\\wireshark.exe")
| search (CommandLine="*-profile*" OR CommandLine="*--profile*" OR CommandLine="*import*")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as cmd by ComputerName, User
| where count >= 1
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="wireshark,cve-2026-96419,">
  <rule id="2026964" level="6">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">wireshark.exe$</field>
    <field name="win.eventdata.commandLine">(?i)(-profile|--profile|import)</field>
    <description>CVE-2026-96419: Possible Wireshark profile import triggering path traversal</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>attack,execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY (two independent sources, OSV and Debian, confirm a fix exists).

1. Immediate mitigations.

   • Treat profile packages as untrusted input. Do not import Wireshark profiles received from external parties, email, chat, or shared repositories unless they have been reviewed and approved.
   • Enforce user awareness guidance: opening/importing an unknown profile on an affected version can crash Wireshark and may allow code execution.
   • Where feasible, restrict the ability to import profiles via endpoint policy or application allow-listing, and monitor process creation for Wireshark with profile-import arguments using the detection rules above.
   • Note: the provided data lists no official vendor workaround (Workarounds: N/A); the above are compensating controls, not vendor-issued fixes.

2. Patch / upgrade steps.

   • Upgrade Wireshark to the fixed release identified by OSV/Debian tracking for the 4.6.x and 4.4.x branches (patch sources: OSV, Debian). Verify the exact fixed version from the vendor download page before deployment.
   • Inventory endpoints for Wireshark installations and confirm versions; identify hosts pinned to any 4.6.0–4.6.8 or 4.4.0–4.4.18 build.
   • After upgrade, re-test the profile-import workflow with an approved profile to confirm normal operation.

3. Long-term hardening.

   • Maintain a software composition/inventory process that tracks desktop analysis tools (not just servers) and subscribes to Wireshark security advisories.
   • Adopt least-privilege execution for capture tools; avoid running Wireshark with elevated privileges where not required.
   • Include client-side tooling in vulnerability SLAs; do not deprioritize non-server software that touches untrusted files.
   • Retain detection content (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) and tune for false positives from legitimate profile management.

References

• NVD — CVE-2026-96419: https://nvd.nist.gov/vuln/detail/CVE-2026-96419
• Wireshark Security Advisories (vendor advisory index): https://www.wireshark.org/security/
• OSV — Open Source Vulnerability database entry for Wireshark (fix confirmation): https://osv.dev/
• Debian Security Tracker — Wireshark: https://security-tracker.debian.org/tracker/source-package/wireshark
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html

Threat actor / exploitation status: CISA KEV status is NO; no known in-the-wild campaign is documented in the provided intelligence. A public proof-of-concept is noted (PoC status: Public), and EPSS is 0.00194 (8.3rd percentile), indicating low but non-zero near-term exploitation likelihood.