Wireshark 4.6.8 Patches 28 Vulnerabilities, Prevents Crashes

Key Takeaways

• Wireshark 4.6.8 has been released to address 28 vulnerabilities that could lead to application crashes.
• The flaws primarily affect various protocol dissectors and file parsers, making the popular network analyzer susceptible to denial-of-service (DoS) conditions.
• Security and network operations teams relying on Wireshark for analysis and incident response are advised to upgrade immediately.
• The update also includes critical stability and memory handling improvements beyond the security patches.

The Wireshark Foundation has issued a crucial security update, Wireshark 4.6.8, designed to rectify 28 vulnerabilities that could cause the network protocol analyzer to crash. This release is vital for maintaining the stability and reliability of a tool indispensable to cybersecurity professionals and network engineers globally.

As the premier solution for network troubleshooting, protocol analysis, software development, and educational purposes, Wireshark is a core component in Security Operations Centers (SOCs) and network engineering environments. Addressing these denial-of-service (DoS) vulnerabilities is paramount to preventing service interruptions during critical tasks such as live packet captures or incident response operations.

Wireshark 4.6.8: A Comprehensive Security Update

The newly patched vulnerabilities, detailed across security advisories wnpa-sec-2026-64 through wnpa-sec-2026-91, impact a wide array of protocol dissectors and internal components within Wireshark. These issues primarily revolve around improper handling of malformed or maliciously crafted network traffic or capture files.

Many of these flaws could lead to a denial-of-service condition, where an attacker on a monitored network segment or one who persuades an analyst to open a specially crafted capture file can trigger a crash in the dissection engine. Such vulnerabilities have historically posed significant operational risks, especially when processing untrusted network data.

Affected Components Highlighted

Several critical components and dissectors are impacted by this update:

• The sharkd headless daemon, central to Wireshark’s operation, is directly affected by multiple vulnerabilities.
• Numerous protocol dissectors, spanning enterprise, wireless, and industrial communication standards, have received patches.

Specific dissectors identified as vulnerable include:

• Enterprise & Security Protocols: Vulnerabilities were found in the dissectors for Remote Desktop Protocol (RDP), Kerberos, SSH, H.245, Cryptographic Message Syntax (CMS), and X.509IF. Notably, advisory wnpa-sec-2026-87 concerning the X.509IF dissector has a pending CVE identifier, indicating its upcoming formal recognition in vulnerability databases.
• Wireless & Cellular Stack: Multiple Bluetooth profiles, including ATT, HFP, AVRCP, and BR/EDR FHS, along with UMTS FP and RRC cellular protocol dissectors, required patching.
• Industrial & Utilities: The C12.22 smart-metering protocol dissector was addressed in two separate advisories.

Beyond protocol dissectors, several file parsing components were also a significant focus of this security release. Wireshark’s input modules for various trace and capture files, including TTX Logger, BUSMASTER, Tektronix K12xx, Endace ERF, Catapult DCT2000, Gammu DCT3, and 3GPP phone logs, received patches to prevent crashes during file parsing. Additionally, specific fixes were deployed for Windows users, addressing crashes in the Ixia IxVeriWave and Vector Informatik BLF file readers.

Additional Stability and Performance Enhancements

As detailed in the official Wireshark 4.6.8 Release Notes, this update extends beyond security fixes to include a range of stability, memory management, and accuracy improvements:

• Buffer and Memory Protection: Patches were implemented for a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in the BLF writer affecting truncated VLAN-tagged Ethernet frames, and a NULL-pointer dereference within the KNXIP Secure Wrapper decryption path.
• Recursion Guardrails: A stack-exhaustion flaw, triggered by excessively nested NetLog JSON payloads, has been resolved.
• 5G Telemetry Accuracy: Decoding logic for 5G NAS information elements, such as S-NSSAI location validity, UE security capability, and SOR transparent container fields, has been corrected.
• UI Performance: A Windows-specific user interface delay impacting the File Capture Properties dialog has been addressed.

While Wireshark 4.6.8 does not introduce new protocol support, it enhances the dissection capabilities for existing protocols like ASN.1 BER, ASTERIX, GTPv2, RELOAD, and Rlogin. Improvements were also made to capture file handling for Daintree SNA and pcapng formats.

A notable packaging adjustment for the 4.6.x release line is also documented: on most UN*X distributions, extcap binaries are now located in the libexec directory instead of the standard library path.

What You Should Do

• Update Immediately: All users of Wireshark, particularly those in security and network operations roles, should upgrade to version 4.6.8 without delay to mitigate the risk of application crashes and potential operational disruption.
• Review Network Segments: Be aware that an attacker on a monitored network segment could exploit these vulnerabilities, so ensure network segmentation and monitoring are robust.
• Exercise Caution with Untrusted Files: Continue to exercise extreme caution when opening capture files from unknown or untrusted sources, as these can be used to trigger denial-of-service conditions.
• Stay Informed: Regularly check the Wireshark security advisories for ongoing updates and information.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.