Loading vulnerability…
Wireshark profile-import denial of service and possible code execution
CVE-2026-96419 is a vulnerability in Wireshark configuration-profile import handling affecting versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Importing a specially crafted profile can crash the application and may permit arbitrary code execution. Exploitation requires persuading a user to import the malicious profile. The underlying defect and specific vulnerable function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash Wireshark, causing denial of service. Arbitrary code execution and system compromise are possible, but the conditions required for code execution and the resulting execution privileges are not specified. Wireshark reported no known active exploitation at the time of publication.
If you can’t patch tonight, do this now.
Until patched, avoid importing configuration profiles from unverified or untrusted sources. Isolate risky analysis workloads in a sandbox or disposable virtual machine and restrict their privileges to reduce potential exposure.
Patch, then assume compromise.
Upgrade Wireshark to version 4.6.9 or later on the 4.6 branch, or 4.4.19 or later on the 4.4 branch. On Debian 13 (trixie), upgrade the affected Wireshark packages to version 4.4.19-0+deb13u1 or a later security-fixed package version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.