This vulnerability (CVE-2026-5656) involves improper limitation of a pathname to a restricted directory (CWE-22) in Wireshark's profile import feature. Specifically, in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, an attacker can exploit path traversal to cause denial of service and possibly execute arbitrary code. The vulnerability has been assigned a CVSS v3.1 base score of 7.0, indicating high severity, with attack vector local, high attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Red Hat has published advisories and issued patches for affected Red Hat Enterprise Linux packages, including Extended Update Support 10.0. The advisories confirm the availability of security updates that fix this vulnerability.

Successful exploitation of this path traversal vulnerability can lead to denial of service and potential arbitrary code execution on affected systems running vulnerable Wireshark versions. The CVSS score of 7.0 reflects high impact on confidentiality, integrity, and availability. This could allow attackers to compromise the affected host by leveraging the profile import functionality.

Red Hat has released security updates that address CVE-2026-5656. Users of affected Wireshark versions (4.6.0 to 4.6.4 and 4.4.0 to 4.4.14) should apply the official patches provided in the Red Hat advisories (RHSA-2026:26182 and related errata) to remediate this vulnerability. Patch status is confirmed by vendor advisories. No additional mitigation steps are indicated beyond applying these updates.