A fresh release of Wireshark—version 4.6.9—delivers fixes for 19 security flaws, some enabling code execution via crafted inputs. Available since September 23, this update also extends to the maintenance 4.4 branch (version 4.4.19) and comes in Windows and macOS installers, plus source code builds.
Main Threats and Major Patch
At the center is a flaw tracked as CVE-2026-96419 (wnpa-sec-2026-106), where a malicious configuration profile could crash Wireshark or allow arbitrary code execution if imported by the user. The vulnerability affects all versions from 4.6.0 through 4.6.8, and from 4.4.0 through 4.4.18; it’s resolved in 4.6.9 and 4.4.19.
While there are no confirmed exploit cases yet, the risk remains serious. Attack vectors could include phishing, bundled analysis tools, untrusted shared resources, or support cases. Analysts often open captures or configurations sourced from outside trusted environments—making such flaws especially dangerous.
Other Security Fixes, Impacted Components
Beyond the headline issue, Wireshark’s update addresses a variety of bugs: crashes, infinite loops, memory leaks, and denial-of-service risks when handling malformed traffic data. Affected dissectors include ZigBee ZCL, SCTP, SPDY, CSN.1, MBIM, Frame, RF4CE, TIFF, X11, IEEE 802.11, Catapult DCT2000, USB HID, and IEEE C37.118. Capture-file parsers for TTL, PEAK CAN TRC, Microsoft Network Monitor, Toshiba formats, and others also had defects.
Additional flaws include a DICOM heap overwrite caused by a 32-bit length wrap, integer overflows in Bluetooth AVCTP and SMB parsing, null pointer issues in PKCS12 handling, and buffer overflow bugs when parsing ETL files with etwdump. Remote code execution risks involving LBMC fragment reassembly and LoRaWAN decryption were also remedied, among other memory and parsing safety problems.
Upgrade Advice & Mitigation Steps
Users are urged to upgrade immediately to Wireshark 4.6.9. Those sticking with the older branch should move to 4.4.19 or later. Until upgraded, avoid importing or opening untrusted configuration profiles or capture files; use sandboxes or virtual machines for analysis; and limit the privileges of automated tools processing network data.
Organizations should ensure that security operations centers (SOCs), forensic labs, jump hosts, and capture appliances are covered. The update is available on the official Wireshark site, where 4.6.9 is listed as the latest stable version.
This release underscores how critical parsing and dissection are in network analysis tools. Vulnerabilities in those components don’t just affect accuracy or performance—they can open doors to serious compromise. Going forward, always treat imported profiles, shared captures, and external tools with suspicion unless verified. Vigilance matters.
