This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in Wireshark's profile import functionality. Specifically, in affected versions, an attacker can craft a profile import path that traverses directories outside the intended scope. This flaw can be exploited to cause denial of service or possibly execute arbitrary code. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and user interaction, but no privileges are required. Confidentiality, integrity, and availability impacts are all rated high.

Successful exploitation can result in denial of service and potential arbitrary code execution on affected systems running vulnerable Wireshark versions. The attacker must have local access and trick a user into importing a malicious profile. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid importing profiles from untrusted sources and restrict local access to trusted users only.