Wireshark CVE-2026-5656

Exploitation requires the victim to import a maliciously crafted Wireshark configuration profile (archive) into a vulnerable client - this user interaction (UI:R) is mandatory and is the primary limiter. The attack vector is local (AV:L): there is no network-triggerable path and no exploitation against default configurations without the import action. No authentication into Wireshark is required (PR:N), but the attacker must deliver the malicious profile and persuade the user to import it, and the target must be running an affected version (4.6.0-4.6.4 or 4.4.0-4.4.14). Impact (code execution vs. denial of service) and the writable locations are bounded by the privileges of the OS user running Wireshark.

Signals are largely consistent and point to a meaningful-but-not-urgent issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 7.8) reflects local attack vector requiring victim interaction (importing a profile) with high impact across confidentiality, integrity and availability - consistent with arbitrary file write enabling DoS and possible code execution. CISA SSVC aligns: Exploitation 'none', Automatable 'no', Technical Impact 'total', i.e. high impact but no observed exploitation and not mass-exploitable. EPSS is 0.01% (2nd percentile), there is no public exploit identified, and the CVE is not in CISA KEV. The principal limiting factor is the social-engineering requirement: an attacker must convince a user to import a malicious profile, which is far less scalable than a remote network bug. Net assessment: a real but lower-priority issue for most environments - patch on a normal cadence; the high CVSS is driven by impact, not by ease or likelihood of exploitation.

An attacker crafts a Wireshark profile archive whose entries contain path-traversal sequences and distributes it (e.g. via a shared 'team profile', forum download, or email) to an analyst. When the victim imports the profile in Wireshark, files are written outside the profile directory, corrupting data to cause a crash/DoS or dropping a file in a location that leads to code execution in the user's context. No public exploit is identified at time of analysis, and the local vector plus required user interaction make this a targeted social-engineering attack rather than mass exploitation.