Loading story…
The Wireshark Foundation released Wireshark 4.6.8 to fix 28 security vulnerabilities that can crash the protocol analyzer during packet analysis, with issues tracked as wnpa-sec-2026-64 through wnpa-sec-2026-91. The flaws affect multiple protocol dissectors, sharkd, the reassembly engine, and numerous capture-file parsers, and several can be triggered simply by opening crafted saved capture files rather than processing live traffic. One advisory affecting the X.509IF dissector (wnpa-sec-2026-87) is still awaiting a CVE identifier.
The update also addresses additional memory-safety and stability problems outside the numbered advisory set, including a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in the BLF writer, a NULL-pointer dereference in KNXIP Secure Wrapper decryption, and stack exhaustion in the NetLog JSON parser. Wireshark 4.6.8 further corrects eight non-crashing 5G decoding errors that displayed incorrect values, alongside operational fixes such as extcap path handling on UNIX-like systems and stability improvements on Windows, underscoring that offline packet-capture handling remains a meaningful attack surface for defenders and analysts.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
The Wireshark Foundation released Wireshark 4.6.8 as a security update that fixes 28 vulnerabilities tracked as wnpa-sec-2026-64 through wnpa-sec-2026-91. The flaws affect multiple protocol dissectors, capture-file parsers, the reassembly engine, and sharkd, and many can be triggered by malformed packet data or crafted capture files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
25 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcewireshark.org
Open sourcewireshark.org
Open sourcegitlab.com
Open sourcegitlab.com
Open sourcegitlab.com
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark released version **4.6.8** with fixes for a large set of security vulnerabilities spanning packet dissectors, codecs, parsers, and related utilities. The advisory tracks issues under `wnpa-sec-2026-08` through `wnpa-sec-2026-50` and describes widespread crash conditions, infinite loops that can trigger denial of service, and several flaws marked as possible code execution, including issues in the **TLS** dissector, **RDP** dissector, **SBC** codec, and profile import functionality. Affected components also include handlers for protocols such as **SMB2**, **HTTP**, **WebSocket**, **ZigBee**, **MySQL**, **ICMPv6**, and **OpenFlow**, highlighting risk across Wireshark’s packet parsing and decompression surface. Supporting issue reports show specific parser weaknesses such as a **BT-DHT dissector stack overflow via nested structs** and an **FC-SWILS dissector stack overflow via nested zone set objects**, while CVE tracking includes identifiers such as `CVE-2026-5408` and `CVE-2026-5409`. The release notes also reference additional non-CVE defects involving memory corruption, integer underflow, heap overflow, parser overflows, and stability problems in **Sharkd**, underscoring that malformed capture data or imported content could crash analysis workflows and, in some cases, potentially lead to code execution.
Aug 21, 2026
Wireshark has released version **4.6.7**, a maintenance update that fixes **12 security vulnerabilities** affecting the processing of untrusted packets and capture or trace files. The flaws primarily allowed crashes through out-of-bounds reads, invalid memory access, and large or infinite processing loops triggered by crafted network traffic or malformed files, while one issue in the **BLF** parser could lead to information disclosure. The patched areas span multiple protocol dissectors and parsers, including **Catapult DCT2000**, **SSH**, **IEEE 802.11**, **Z39.50**, **UMTS FP**, the **pcapng** reader, **DBS Etherwatch**, the **TLS ECH** decryption path, and the **CiscoDump extcap** helper. The release also fixes **16 non-security bugs**, updates several protocol handlers, and notes that on Unix-like systems, `extcap` binaries are now searched under the **libexec** directory by default.
Jul 11, 2026
The Wireshark Foundation released **Wireshark 4.6.4**, a maintenance update that patches multiple security flaws in protocol dissectors that could be triggered by malformed or edge-case traffic to cause **denial-of-service conditions** (e.g., crashes, infinite loops, or resource exhaustion) during packet analysis. Reported fixes include issues leading to **memory exhaustion** in the USB HID dissector and crash conditions affecting dissectors such as **NTS-KE** and **RF4CE**, reducing the risk that crafted captures or live traffic could disrupt analyst workflows or automated inspection pipelines. Wireshark 4.6.4 also addresses additional dissector stability problems, including a **crash in the HTTP3 dissector** and an **infinite loop in the MEGACO dissector**, and it resolves a **plugin compatibility** regression introduced by an API/ABI change in 4.6.1 that impacted plugins built for 4.6.0. Beyond security-related fixes, the release includes stability and performance improvements (including an “Expert Info” performance issue and various capture-file and toolchain fixes affecting utilities like *TShark* and *editcap*), supporting more reliable operation in enterprise monitoring, incident response, and malware analysis environments.
Jun 29, 2026