This advisory covers two security vulnerabilities in Wireshark packages distributed with Red Hat Enterprise Linux 10 and CodeReady Linux Builder 10. CVE-2026-5405 is a heap-based buffer overflow vulnerability, and CVE-2026-5656 is a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. Both vulnerabilities have been fixed in updated Wireshark packages (version 4.4.2-10.el10_2). The update is rated as Important by Red Hat Product Security. The advisory includes detailed package information for multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

The heap-based buffer overflow (CVE-2026-5405) could lead to memory corruption, potentially allowing an attacker to crash the application or execute arbitrary code. The path traversal vulnerability (CVE-2026-5656) could allow an attacker to access files outside of intended directories, potentially exposing sensitive information or enabling unauthorized file operations. The advisory rates the overall security impact as Important, indicating a high risk if unpatched.

Red Hat has released updated Wireshark packages (version 4.4.2-10.el10_2) for Red Hat Enterprise Linux 10 and CodeReady Linux Builder 10 that fix these vulnerabilities. Users should apply these updates promptly following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated or required beyond applying the official update.