Wireshark EUVD-2026-88712

Exploitation requires the victim to manually import a maliciously crafted Wireshark configuration profile - this user-interaction step (UI:R) and the local attack vector (AV:L) are the primary limiting factors, since there is no network-facing or automatic trigger. No authentication to the product is needed (PR:N), but the attacker depends entirely on social engineering to get the crafted profile delivered and imported. Only Wireshark versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8 are affected; the path-traversal flaw (CWE-22) is in the profile import handling specifically, so environments where analysts never import externally sourced profiles face minimal exposure.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.8 is driven by HIGH confidentiality, integrity, and availability impact (C:H/I:H/A:H) reflecting the 'possible code execution' outcome, but the exploitability metrics meaningfully constrain real-world risk: the attack vector is LOCAL (AV:L) and requires user interaction (UI:R), meaning a victim must be convinced to import a malicious Wireshark profile rather than an attacker reaching the target over the network. Supporting signals align with a lower-urgency picture: EPSS is only 0.19% (7th percentile), SSVC marks Exploitation as 'poc' (not active), Automatable as 'no', and Technical Impact as 'partial', and the vulnerability is NOT listed in CISA KEV. Note one internal tension worth flagging: the SSVC 'Technical Impact: partial' rating is softer than the full C:H/I:H/A:H in the CVSS vector and the 'possible code execution' language - the word 'possible' suggests code execution is not reliably demonstrated, so the HIGH integrity/confidentiality impact should be treated as a worst-case upper bound rather than a confirmed capability. Net: a real but not widespread threat, best handled via normal patch cycles with priority for analysts who routinely import third-party capture profiles.

An attacker crafts a malicious Wireshark configuration profile (leveraging the CWE-22 path traversal weakness) and distributes it via a forum, shared incident-response bundle, or email to a network analyst. When the victim imports the profile into a vulnerable Wireshark version (4.4.0-4.4.18 or 4.6.0-4.6.8), the import logic crashes, causing denial of service and potentially executing attacker-controlled code in the analyst's user context. Public proof-of-concept material exists per the SSVC assessment, but no active exploitation has been reported.