{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96419", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-09-23T05:41:40.658Z", "datePublished": "2026-09-29T09:30:48.021Z", "dateUpdated": "2026-09-29T09:30:48.021Z"}, "containers": {"cna": {"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark", "descriptions": [{"lang": "en", "value": "Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution"}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "versions": [{"version": "4.6.0", "status": "affected", "lessThan": "4.6.9", "versionType": "semver"}, {"version": "4.4.0", "status": "affected", "lessThan": "4.4.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-106.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21553"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.9 or above"}], "credits": [{"lang": "en", "value": "\uacbd\ubc30 \uc9c0", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-09-29T09:30:48.021Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wireshark", "repo": "https://gitlab.com/wireshark/wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.9", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.19", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution"}], "id": "CVE-2026-96419", "lastModified": "2026-09-29T10:17:16.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-09-29T10:17:16.640", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21553"}, {"source": "cve@gitlab.com", "url": "https://www.wireshark.org/security/wnpa-sec-2026-106.html"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark", "id": "2543041", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543041"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Wireshark. Due to improper pathname validation during configuration profile imports, an attacker could convince a user to import a maliciously crafted profile. Successful exploitation could allow arbitrary code execution or cause an application crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-96419", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-29T09:30:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96419\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96419\nhttps://gitlab.com/wireshark/wireshark/-/work_items/21553\nhttps://www.wireshark.org/security/wnpa-sec-2026-106.html"], "threat_severity": "Moderate"}

{}