This vulnerability arises when Wireshark imports a profile, allowing an attacker to supply a file path that escapes the intended directory boundaries. The flaw can cause the application to crash, resulting in service disruption. In some configurations, the attacker may leverage the path that reaches arbitrary files, setting the stage for unintended code execution. The weakness is formally identified as a path traversal error, classified under CWE-22.

Wireshark Foundation's Wireshark product is affected. Versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 are vulnerable. Any installation running within these version ranges without the patch is at risk.

The CVSS score of 5.5 places the issue in the medium severity band. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector inferred is local or network-based profile import, where an attacker can supply a crafted profile file. If exploited, the result would be a denial of service or possible code execution depending on file system permissions and the context in which Wireshark runs.