CVE-2026-5656
Published: 01 May 2026
Summary
CVE-2026-5656 is a high-severity Path Traversal (CWE-22) vulnerability in Wireshark Wireshark. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely identification, reporting, and correction of the path traversal flaw in Wireshark profile import.
Prevents path traversal exploitation by enforcing validation and error handling of file paths and inputs during profile import operations.
Detects unauthorized file modifications or code execution resulting from successful path traversal in profile imports via integrity monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The path traversal vulnerability in Wireshark's profile import functionality is triggered when a user imports a malicious profile file, enabling code execution or DoS. This directly facilitates Exploitation for Client Execution (T1203) via a vulnerable client application and User Execution via Malicious File (T1204.002) due to the required user interaction to import the crafted profile.
NVD Description
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Deeper analysisAI
CVE-2026-5656 is a path traversal vulnerability (CWE-22) affecting the profile import functionality in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Published on 2026-05-01, it enables denial of service and potential code execution. The issue has a CVSS v3.1 base score of 7.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability, though it requires high attack complexity and user interaction, such as convincing a user to import a malicious profile. No privileges are needed (PR:N). Successful exploitation leads to high impacts on confidentiality, integrity, and availability, manifesting as denial of service or possible arbitrary code execution.
Mitigation details are available in the Wireshark security advisory WNPA-SEC-2026-21 at https://www.wireshark.org/security/wnpa-sec-2026-21.html and the related GitLab issue at https://gitlab.com/wireshark/wireshark/-/issues/21115.
Details
- CWE(s)