# CVE-2026-96419: Wireshark profile import path traversal code execution

Source: https://junglewise.ai/threats/cve-2026-96419-profile-import-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-96419 · Severity: medium · CVSS 5.5 · Published 2026-09-29

Wireshark is a network packet analyzer used by IT and security teams to diagnose network issues. An attacker can craft a malicious configuration profile file that, when imported by a user, writes arbitrary Lua code to Wireshark's plugins directory without warning. When Wireshark restarts, it loads and executes this code, leading to complete system compromise. The vulnerability affects Windows systems exclusively due to a platform-specific code guard that disabled a critical security check.

Technologies: [Wireshark Foundation Wireshark](https://junglewise.ai/threats/technologies/wireshark-foundation-wireshark). Vendors: [Wireshark Foundation](https://junglewise.ai/threats/vendors/wireshark-foundation).

## Quick answers

**Is CVE-2026-96419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96419 being exploited in the wild.

**How severe is CVE-2026-96419?** Medium severity, with a CVSS score of 5.5, published 29 September 2026.

**Which products and versions are affected?** Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18 (Windows only).

**Is there a fix for CVE-2026-96419?** A patch was published on 2026-09-29: Fixed in versions 4.6.9 and 4.4.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96419 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-96419?** Check whether you run Wireshark Foundation Wireshark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability in WiresharkZipHelper::unzip() (ui/qt/utils/wireshark_zip_helper.cpp) allows ZIP entries with relative path sequences like "../../../" to escape the extraction directory on Windows. The containment check was wrapped in #ifndef _WIN32, disabling it on Windows, while the Windows-only fallback check only blocks absolute paths. Exploitation requires user interaction (importing a ZIP profile) and results in arbitrary code execution via unsandboxed Lua script loading at startup.

## Affected products

- Wireshark Foundation Wireshark 4.6.0 to 4.6.8, 4.4.0 to 4.4.18 (Windows only)

## Timeline

- 2026-09-23: disclosed
- 2026-09-29: patched: Fixed in versions 4.6.9 and 4.4.19

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21553](https://gitlab.com/wireshark/wireshark/-/work_items/21553)
- [https://www.wireshark.org/security/wnpa-sec-2026-106.html](https://www.wireshark.org/security/wnpa-sec-2026-106.html)

## Related threats

- [Wireshark X11 dissector out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-96423-x11-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4)
- [Wireshark Frame protocol metadissector crash](https://junglewise.ai/threats/cve-2026-96422-frame-protocol-metadissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to)
- [Wireshark Toshiba file parser crash](https://junglewise.ai/threats/cve-2026-96420-toshiba-file-parser-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4-18)
- [Wireshark TIFF dissector infinite loop](https://junglewise.ai/threats/cve-2026-96418-tiff-protocol-dissector-infinite-loop-in-4-6-0-to-4-6-8-and-4-4-0)
- [Wireshark RF4CE protocol dissector buffer overflow](https://junglewise.ai/threats/cve-2026-96417-rf4ce-protocol-dissector-crash-in-4-6-0-to-4-6-8-and-4-4-0-to-4-4)