Wireshark 4.6.8 Released to Patch 28 Security Vulnerabilities

Wireshark has released version 4.6.8, which addresses security vulnerabilities in 28 identified issues that could lead to crashes, abnormal exits, memory-safety problems, and denial-of-service conditions when the network protocol analyzer handles specially crafted traffic or capture files.

This update is particularly important for security analysts, incident responders, network administrators, and researchers who frequently work with untrusted packet captures, analyze diagnostic traces, or inspect complex protocol traffic.

Wireshark 4.6.8 Released

Wireshark is a widely used, open-source network protocol analyzer maintained by the Wireshark Foundation. It enables users to capture, inspect, decode, and troubleshoot network communications across a broad range of protocols and file formats.

Because the application processes potentially attacker-controlled input, including live traffic, PCAP/PCAPNG captures, Bluetooth traces, telecom logs, and vendor-specific capture formats, vulnerabilities in its parsers and dissectors can pose significant risks to users analyzing suspicious files.

The 4.6.8 release addresses vulnerabilities tracked from WNPA-SEC-2026-64 to WNPA-SEC-2026-91. A significant portion of the fixed vulnerabilities relates to crashes in protocol dissectors, including those for UMTS FP, RDP, Bluetooth Attribute Protocol, C12.22, CMS, H.245, Kerberos, SSH, ESS, RRC, X.509IF, Bluetooth HFP, Bluetooth BR/EDR FHS, and Bluetooth AVRCP.

Affected systems might crash while trying to decode malformed protocol data. While the release notes mainly describe these issues as crashes, organizations should treat malformed capture files and traffic samples as untrusted until they have upgraded.

Several flaws also impact sharkd, Wireshark’s daemon-oriented component that provides packet-analysis capabilities to other applications. Specifically, WNPA-SEC-2026-64 and WNPA-SEC-2026-65 resolve crash conditions in sharkd.

Environments that integrate Wireshark tools into automated analysis pipelines, web interfaces, or collaborative forensic platforms should prioritize assessing their exposure to sharkd and promptly applying the update.

Capture-file parsing is another key focus of this release. Wireshark 4.6.8 fixes issues in several formats, including TTX Logger, BUSMASTER, Tektronix K12xx, Endace ERF, Catapult DCT2000, 3GPP phone logs, Ixia IxVeriWave, Vector Informatik BLF, pcapng, and Gammu DCT3 processing.

These formats are commonly encountered in enterprise networking, automotive testing, telecom analysis, and hardware troubleshooting. An attacker could exploit a malicious capture file, leading an analyst to open it during an investigation, making it crucial for defensive teams to enhance file-parser security.

In addition to the listed security advisories, the update resolves other stability and memory-handling defects. Noteworthy fixes include addressing a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in the BLF writer, a recursion condition in DLMS/COSEM decoding that could exhaust the stack, a NULL-pointer dereference in KNX/IP Secure Wrapper processing, and a global out-of-bounds read caused by a signed Bluetooth snoop length in androiddump.

Wireshark also fixed deep NetLog JSON nesting that could exhaust the native stack and addressed an integer-overflow issue involving unbounded Daintree timestamp fractions.

The release further enhances decoding for several 5G NAS information elements, correcting errors related to S-NSSAI location validity, NSAG information, UE security capability, registration wait range, Extended CAG information, and Service on Request containers.

Although Wireshark 4.6.8 does not introduce new protocol support, it improves support across numerous protocols and capture formats, reinforcing the tool’s reliability for modern network and telecom analysis.

Users are encouraged to upgrade their Wireshark installations to version 4.6.8 as soon as operationally feasible. Security teams should also update any analysis workstations, sandboxes, automated pipelines, and shared forensic environments that process untrusted packet captures.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world