Loading story…
Wireshark released version 4.6.5 to remediate more than 40 vulnerabilities, including multiple flaws that could allow arbitrary code execution when the tool processes malformed network packets or malicious capture and profile files. The most severe issues were reported in the TLS dissector, SBC codec, RDP dissector, and profile import functionality, where crashes may be exploitable for code execution.
The release also fixes a broad set of denial-of-service bugs across numerous protocol dissectors, several infinite-loop conditions that can stall unattended analysis workflows, and decompression-related crashes in zlib and LZ77 handling. Because Wireshark is widely deployed in enterprise security operations, packet analysis, and SIEM-connected environments—sometimes with elevated privileges—the patched version is being treated as a high-priority security update.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Wireshark released version 4.6.5 to address more than 40 security flaws, including vulnerabilities that could allow arbitrary code execution via malformed packets or malicious capture/profile files. The fixes also covered numerous denial-of-service issues, infinite-loop bugs, and decompression-related crashes affecting multiple protocol dissectors and engine components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcelists.debian.org
Open sourceisc.sans.edu
Open sourcecybersecuritynews.com
Open sourceerrata.rockylinux.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark released version **4.6.8** with fixes for a large set of security vulnerabilities spanning packet dissectors, codecs, parsers, and related utilities. The advisory tracks issues under `wnpa-sec-2026-08` through `wnpa-sec-2026-50` and describes widespread crash conditions, infinite loops that can trigger denial of service, and several flaws marked as possible code execution, including issues in the **TLS** dissector, **RDP** dissector, **SBC** codec, and profile import functionality. Affected components also include handlers for protocols such as **SMB2**, **HTTP**, **WebSocket**, **ZigBee**, **MySQL**, **ICMPv6**, and **OpenFlow**, highlighting risk across Wireshark’s packet parsing and decompression surface. Supporting issue reports show specific parser weaknesses such as a **BT-DHT dissector stack overflow via nested structs** and an **FC-SWILS dissector stack overflow via nested zone set objects**, while CVE tracking includes identifiers such as `CVE-2026-5408` and `CVE-2026-5409`. The release notes also reference additional non-CVE defects involving memory corruption, integer underflow, heap overflow, parser overflows, and stability problems in **Sharkd**, underscoring that malformed capture data or imported content could crash analysis workflows and, in some cases, potentially lead to code execution.
Aug 21, 2026
Wireshark disclosed and patched a broad set of vulnerabilities across its packet analysis engine, protocol dissectors, codecs, decompression routines, and the `sharkd` backend, with the most serious issues including possible code execution, memory corruption, and denial of service. The release notes for **Wireshark 4.6.6** aggregate advisories `wnpa-sec-2026-08` through `wnpa-sec-2026-50`, while earlier coordinated fixes shipped in **4.6.5** and **4.4.15** for affected `4.6.0-4.6.4` and `4.4.0-4.4.14` branches. One high-severity flaw, tracked as **CVE-2026-5656**, allowed a crafted configuration-profile ZIP to escape the intended extraction path and plant a Lua plugin for execution on the next launch. Additional issues included crashes and memory-safety bugs in AMR-NB (`CVE-2026-5654`), iLBC (`CVE-2026-5657`), ASN.1 PER (`CVE-2026-6527`), DCP-ETSI (`CVE-2026-5653`, `CVE-2026-6530`), and later `sharkd` and Bluetooth AVRCP flaws that could crash the process or potentially enable control-flow hijack. Several vulnerabilities were reachable simply by opening a malicious packet capture or by parsing malformed traffic on the wire. Wireshark documented infinite-loop and CPU-exhaustion conditions in the USB HID dissector (**CVE-2026-6534**), OpenFlow v5 dissector (**CVE-2026-6521**), and LZ77 decompression path (**CVE-2026-6533**), alongside crashes in BEEP (**CVE-2026-6538**) and other protocol handlers. GitLab issue reports show researchers and fuzzing jobs repeatedly triggering heap overflows, double-free conditions, NULL dereferences, and non-advancing-offset parser failures in components such as DCP-ETSI, H.245, MIH, eDonkey, and `sharkd`, underscoring that malformed captures can destabilize both the GUI and `tshark`. Wireshark said it was not aware of active exploitation at disclosure time and urged users to update to the fixed releases.
Aug 21, 2026
The Wireshark Foundation released **Wireshark 4.6.4**, a maintenance update that patches multiple security flaws in protocol dissectors that could be triggered by malformed or edge-case traffic to cause **denial-of-service conditions** (e.g., crashes, infinite loops, or resource exhaustion) during packet analysis. Reported fixes include issues leading to **memory exhaustion** in the USB HID dissector and crash conditions affecting dissectors such as **NTS-KE** and **RF4CE**, reducing the risk that crafted captures or live traffic could disrupt analyst workflows or automated inspection pipelines. Wireshark 4.6.4 also addresses additional dissector stability problems, including a **crash in the HTTP3 dissector** and an **infinite loop in the MEGACO dissector**, and it resolves a **plugin compatibility** regression introduced by an API/ABI change in 4.6.1 that impacted plugins built for 4.6.0. Beyond security-related fixes, the release includes stability and performance improvements (including an “Expert Info” performance issue and various capture-file and toolchain fixes affecting utilities like *TShark* and *editcap*), supporting more reliable operation in enterprise monitoring, incident response, and malware analysis environments.
Jun 29, 2026