Loading story…
Wireshark has released version 4.6.7, a maintenance update that fixes 12 security vulnerabilities affecting the processing of untrusted packets and capture or trace files. The flaws primarily allowed crashes through out-of-bounds reads, invalid memory access, and large or infinite processing loops triggered by crafted network traffic or malformed files, while one issue in the BLF parser could lead to information disclosure.
The patched areas span multiple protocol dissectors and parsers, including Catapult DCT2000, SSH, IEEE 802.11, Z39.50, UMTS FP, the pcapng reader, DBS Etherwatch, the TLS ECH decryption path, and the CiscoDump extcap helper. The release also fixes 16 non-security bugs, updates several protocol handlers, and notes that on Unix-like systems, extcap binaries are now searched under the libexec directory by default.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Wireshark released version 4.6.7 as a maintenance update that fixes twelve security vulnerabilities affecting multiple protocol dissectors and capture-file parsers that process untrusted packet and trace data. The issues included crash-causing out-of-bounds reads, invalid memory access, infinite or large loops, and an information disclosure flaw in the BLF parser.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcethecyberexpress.com
Open sourcehelpnetsecurity.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Wireshark Foundation released **Wireshark 4.6.8** to fix **28 security vulnerabilities** that can crash the protocol analyzer during packet analysis, with issues tracked as `wnpa-sec-2026-64` through `wnpa-sec-2026-91`. The flaws affect multiple protocol dissectors, `sharkd`, the reassembly engine, and numerous capture-file parsers, and several can be triggered simply by opening **crafted saved capture files** rather than processing live traffic. One advisory affecting the **X.509IF dissector** (`wnpa-sec-2026-87`) is still awaiting a CVE identifier. The update also addresses additional memory-safety and stability problems outside the numbered advisory set, including a **stack buffer overflow** in the **K12/RF5 writer**, an **out-of-bounds read** in the **BLF writer**, a **NULL-pointer dereference** in **KNXIP Secure Wrapper** decryption, and **stack exhaustion** in the **NetLog JSON parser**. Wireshark 4.6.8 further corrects eight non-crashing **5G decoding errors** that displayed incorrect values, alongside operational fixes such as extcap path handling on UNIX-like systems and stability improvements on Windows, underscoring that offline packet-capture handling remains a meaningful attack surface for defenders and analysts.
Aug 21, 2026
The Wireshark Foundation released **Wireshark 4.6.4**, a maintenance update that patches multiple security flaws in protocol dissectors that could be triggered by malformed or edge-case traffic to cause **denial-of-service conditions** (e.g., crashes, infinite loops, or resource exhaustion) during packet analysis. Reported fixes include issues leading to **memory exhaustion** in the USB HID dissector and crash conditions affecting dissectors such as **NTS-KE** and **RF4CE**, reducing the risk that crafted captures or live traffic could disrupt analyst workflows or automated inspection pipelines. Wireshark 4.6.4 also addresses additional dissector stability problems, including a **crash in the HTTP3 dissector** and an **infinite loop in the MEGACO dissector**, and it resolves a **plugin compatibility** regression introduced by an API/ABI change in 4.6.1 that impacted plugins built for 4.6.0. Beyond security-related fixes, the release includes stability and performance improvements (including an “Expert Info” performance issue and various capture-file and toolchain fixes affecting utilities like *TShark* and *editcap*), supporting more reliable operation in enterprise monitoring, incident response, and malware analysis environments.
Jun 29, 2026
Wireshark released version **4.6.5** to remediate more than 40 vulnerabilities, including multiple flaws that could allow **arbitrary code execution** when the tool processes malformed network packets or malicious capture and profile files. The most severe issues were reported in the **TLS dissector**, **SBC codec**, **RDP dissector**, and **profile import** functionality, where crashes may be exploitable for code execution. The release also fixes a broad set of **denial-of-service** bugs across numerous protocol dissectors, several **infinite-loop** conditions that can stall unattended analysis workflows, and decompression-related crashes in **zlib** and **LZ77** handling. Because Wireshark is widely deployed in enterprise security operations, packet analysis, and SIEM-connected environments—sometimes with elevated privileges—the patched version is being treated as a high-priority security update.
Jun 29, 2026