Is CVE-2026-96419 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96419 being exploited in the wild.

How severe is CVE-2026-96419?

Medium severity, with a CVSS score of 5.5, published 29 September 2026.

Which products and versions are affected?

Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18 (Windows only).

Is there a fix for CVE-2026-96419?

A patch was published on 2026-09-29: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96419 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-96419?

Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96419: Wireshark profile import path traversal code execution

CVE-2026-96419 · Severity: medium · CVSS 5.5 · Published 2026-09-29

Wireshark is a network packet analyzer used by IT and security teams to diagnose network issues. An attacker can craft a malicious configuration profile file that, when imported by a user, writes arbitrary Lua code to Wireshark's plugins directory without warning. When Wireshark restarts, it loads and executes this code, leading to complete system compromise. The vulnerability affects Windows systems exclusively due to a platform-specific code guard that disabled a critical security check.

Technologies: Wireshark Foundation Wireshark. Vendors: Wireshark Foundation.

Quick answers

Is CVE-2026-96419 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96419 being exploited in the wild.
How severe is CVE-2026-96419?: Medium severity, with a CVSS score of 5.5, published 29 September 2026.
Which products and versions are affected?: Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18 (Windows only).
Is there a fix for CVE-2026-96419?: A patch was published on 2026-09-29: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96419 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-96419?: Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability in WiresharkZipHelper::unzip() (ui/qt/utils/wireshark_zip_helper.cpp) allows ZIP entries with relative path sequences like "../../../" to escape the extraction directory on Windows. The containment check was wrapped in #ifndef _WIN32, disabling it on Windows, while the Windows-only fallback check only blocks absolute paths. Exploitation requires user interaction (importing a ZIP profile) and results in arbitrary code execution via unsandboxed Lua script loading at startup.

Affected products

Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18 (Windows only)

Timeline

2026-09-23: disclosed
2026-09-29: patched: Fixed in versions 4.6.9 and 4.4.19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.