Loading story…
Wireshark released versions 4.6.9 and 4.4.19, addressing 19 documented security vulnerabilities and 16 additional bugs. The fixes span protocol dissectors, capture-file parsers, Sharkd, and configuration-profile handling, with many flaws triggered by malformed input capable of crashing the application, causing excessive or infinite loops, leaking memory, or creating denial-of-service conditions for analysts opening untrusted captures and related files.
The most significant issue, CVE-2026-96419 (wnpa-sec-2026-106), can be triggered by importing a crafted configuration profile and may crash Wireshark or potentially enable arbitrary code execution. Wireshark reported no known active exploitation, but organizations should promptly update deployments and avoid or isolate untrusted configuration profiles, packet captures, and other input files until patched.
See affected versions and whether adversaries are exploiting it.
32 events from the most recent confirmed update back to the earliest known activity.
Debian issued security advisory DSA-6541-1, fixing 16 Wireshark vulnerabilities that could cause denial of service or arbitrary code execution in Debian 13 (trixie). The fixes are included in version 4.4.19-0+deb13u1, and Debian recommends upgrading affected packages.
Tenable published CVE-2026-96423 as an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and Wireshark CLI and development packages on Red Hat Enterprise Linux 10. Its CVSS v3 vector describes a locally exploitable, user-interaction-required issue with high availability impact and no known exploits, although its supplied CVSS v2 vector conflicts on attack conditions and impact.
Tenable published a Nessus Unix-agent finding for CVE-2026-96421, an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and wireshark-cli and wireshark-devel packages on Red Hat Enterprise Linux 10. The locally exploitable, user-interaction-required issue has high availability impact, and Tenable reported no known exploits.
Tenable published a Nessus Unix-plugin notice identifying CVE-2026-96417 as unpatched in Wireshark packages for Debian 12, 13, and 14 and wireshark-cli and wireshark-devel on Red Hat Enterprise Linux 10. The locally accessible flaw requires user interaction, has high availability impact, and had no known exploits reported.
Tenable published an unpatched Nessus Unix-plugin finding for CVE-2026-96415 affecting Wireshark packages on Debian 12, 13, and 14 and wireshark-cli and wireshark-devel packages on Red Hat Enterprise Linux 10. The locally exploitable flaw requires user interaction, has high availability impact, and had no known exploits reported.
Tenable published a notice identifying CVE-2026-95388 as an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and Wireshark, wireshark-cli, and wireshark-devel packages on Red Hat Enterprise Linux 10. The locally accessible, user-interaction-required flaw has high availability impact, and no known exploits were reported.
Tenable identified CVE-2026-95392 as an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and Wireshark CLI and development packages on Red Hat Enterprise Linux 10. The locally accessible, user-interaction-required flaw has high availability impact, and no known exploits were reported.
Tenable published a Nessus Unix-plugin notice identifying CVE-2026-96419 as unpatched in Wireshark packages for Debian 12, 13, and 14 and Red Hat Enterprise Linux 10. The notice characterizes it as a locally exploitable, user-interaction-required availability issue and reports no known exploits.
Tenable published CVE-2026-96418 as an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and Wireshark CLI/development packages on Red Hat Enterprise Linux 10. The CVSS v3 assessment describes a locally exploitable, user-interaction-required issue with high availability impact; no known exploits were reported.
Tenable identified CVE-2026-96420 as an unpatched Wireshark vulnerability affecting Debian 12, 13, and 14 and Wireshark CLI/development packages on Red Hat Enterprise Linux 10. The locally accessible, high-complexity flaw requires user interaction, has high availability impact, and had no known exploits reported.
Tenable published CVE-2026-96422 as an unpatched, locally exploitable availability vulnerability affecting Wireshark-related packages on Debian 12, 13, and 14 and Red Hat Enterprise Linux 10. The CVSS v3 vector indicates low complexity, required user interaction, no privileges, and high availability impact; no known exploits were reported.
Wireshark advisory WNPA-SEC-2026-97 documents CVE-2026-95387, a heap-based buffer-overflow vulnerability in the SPDY protocol dissector that can cause a denial of service through a crash. It affects Wireshark versions 4.6.0–4.6.8 and 4.4.0–4.4.18; the CVE record was received by cve@gitlab.com on September 29, 2026.
Wireshark advisory WNPA-SEC-2026-93 documents CVE-2026-95389, a heap-based buffer-overflow issue in the SCTP protocol dissector that can crash affected Wireshark versions 4.6.0–4.6.8 and 4.4.0–4.4.18. The CVE record was received by cve@gitlab.com on September 29, 2026.
Wireshark identified CVE-2026-96419 (wnpa-sec-2026-106), affecting versions 4.6.0–4.6.8 and 4.4.0–4.4.18. A crafted configuration profile could crash Wireshark or potentially execute arbitrary code when imported; Wireshark said it was unaware of active exploitation.
Wireshark released versions 4.6.9 and 4.4.19, addressing 19 documented vulnerabilities and 16 additional bugs. The fixes cover protocol dissectors, capture-file parsers, Sharkd, and configuration-profile handling.
TuxCare published Important Rocky Linux 9.6 advisory CLSA-2026-1785491682, addressing 28 Wireshark-related CVEs, including CVE-2026-7378. The associated Nessus plugin reports exploits are available; CVE-2026-7378 is an unauthenticated, low-complexity network denial-of-service issue with high availability impact.
TuxCare published Important AlmaLinux 9.6 advisory CLSA-2026-1785491682, addressing 28 Wireshark-related CVEs, including CVE-2026-7378. The Nessus plugin reports exploits are available; CVE-2026-7378 is an unauthenticated, low-complexity network denial-of-service issue with high availability impact.
TuxCare published Moderate Rocky Linux 9.6 advisory CLSA-2026-1785518972, addressing CVE-2026-5401, CVE-2026-5406, CVE-2026-5408, CVE-2026-6527, and CVE-2026-6538. The associated Nessus plugin reports that exploits are available for vulnerabilities covered by the update.
TuxCare published Moderate AlmaLinux 9.6 advisory CLSA-2026-1785518972, addressing CVE-2026-5401, CVE-2026-5406, CVE-2026-5408, CVE-2026-6527, and CVE-2026-6538. The associated Nessus plugin reports that exploits are available for vulnerabilities covered by the update.
TuxCare published Important AlmaLinux 9.2 advisory CLSA-2026-1785337661, addressing seven Wireshark-related CVEs including CVE-2023-1992, CVE-2026-7378, and CVE-2026-15169. The associated Nessus plugin reports exploits are available; CVE-2026-7378 is network-reachable and can cause high availability impact.
TuxCare published AlmaLinux 9.2 advisory CLSA-2026-1783432450 to address CVE-2026-9759. The moderate-severity flaw requires local access and user interaction and can cause high availability impact; no known exploits were reported.
TuxCare published Rocky Linux 9.6 security update CLSA-2026-1783434011 to address CVE-2026-9759. The moderate-severity flaw requires local access and user interaction and can cause high availability impact; no known exploits were reported.
TuxCare published a patch for CVE-2026-9759 affecting AlmaLinux 9.6. The moderate-severity flaw requires local access and user interaction and can cause high availability impact; the notice reported no known exploits.
TuxCare published Rocky Linux 9.6 advisory CLSA-2026-1775032927, rated Important, to address 11 Wireshark-related CVEs, including CVE-2023-6175 and CVE-2025-5601. The associated Nessus check states that exploits are available for vulnerabilities covered by the advisory.
TuxCare published an Important AlmaLinux 9.6 advisory, CLSA-2026-1775032927, addressing 11 Wireshark-related CVEs, including CVE-2023-6175, CVE-2024-0208, and CVE-2025-5601. The associated Nessus plugin states that exploits are available for vulnerabilities covered by the update.
TuxCare published Moderate AlmaLinux 9.2 advisory CLSA-2025-1766501828 to address CVE-2025-13499. The flaw requires local access and user interaction and has high availability impact; the Nessus plugin reported no known exploits.
A Tenable Nessus Unix-agent plugin identified CVE-2026-95390 as an unpatched condition affecting Debian Linux 14.0 systems with Wireshark installed. The issue is locally accessible, requires user interaction, has high availability impact, and had no known exploits reported; the notice lists a vulnerability-publication date of November 19, 2025 despite the 2026 CVE identifier.
A Tenable Nessus Unix-agent plugin identified CVE-2026-95391 as an unpatched condition affecting Debian Linux 14.0, with CPE data referencing Wireshark. Its CVSS v3 vector describes a locally accessible, user-interaction-required issue with high availability impact and no known exploits; the notice's listed vulnerability-publication date is November 19, 2025 despite the CVE's 2026 identifier.
A Tenable Nessus plugin identified CVE-2026-95389 as unpatched in Wireshark-related packages on Debian 12, 13, and 14 and Red Hat Enterprise Linux 10. The plugin reported no known exploits and supplied conflicting CVSS v2 and v3 assessments, including network access and high confidentiality, integrity, and availability impact in CVSS v3.
A Tenable Nessus plugin identified CVE-2026-95395 as an unpatched, locally exploitable Wireshark-related vulnerability affecting Debian 12, 13, and 14 and Wireshark CLI/development packages on Red Hat Enterprise Linux 10. The issue requires user interaction, has high availability impact, and had no known exploits reported; its listed vulnerability-publication date is October 8, 2024 despite the 2026 CVE identifier.
Tenable identified CVE-2026-95394 as an unpatched, locally exploitable Wireshark denial-of-service vulnerability affecting packages for multiple Ubuntu LTS releases and Debian 12, 13, and 14. The notice states that no known exploits are available, but its listed vulnerability-publication date is internally inconsistent with the CVE year and should be validated.
Wireshark developers fixed 28 denial-of-service vulnerabilities in a separate remediation effort in August. The reference does not provide a year or further release details for that event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
34 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceheise.de
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark released version **4.6.5** to remediate more than 40 vulnerabilities, including multiple flaws that could allow **arbitrary code execution** when the tool processes malformed network packets or malicious capture and profile files. The most severe issues were reported in the **TLS dissector**, **SBC codec**, **RDP dissector**, and **profile import** functionality, where crashes may be exploitable for code execution. The release also fixes a broad set of **denial-of-service** bugs across numerous protocol dissectors, several **infinite-loop** conditions that can stall unattended analysis workflows, and decompression-related crashes in **zlib** and **LZ77** handling. Because Wireshark is widely deployed in enterprise security operations, packet analysis, and SIEM-connected environments—sometimes with elevated privileges—the patched version is being treated as a high-priority security update.
Jun 29, 2026
Wireshark released version **4.6.8** with fixes for a large set of security vulnerabilities spanning packet dissectors, codecs, parsers, and related utilities. The advisory tracks issues under `wnpa-sec-2026-08` through `wnpa-sec-2026-50` and describes widespread crash conditions, infinite loops that can trigger denial of service, and several flaws marked as possible code execution, including issues in the **TLS** dissector, **RDP** dissector, **SBC** codec, and profile import functionality. Affected components also include handlers for protocols such as **SMB2**, **HTTP**, **WebSocket**, **ZigBee**, **MySQL**, **ICMPv6**, and **OpenFlow**, highlighting risk across Wireshark’s packet parsing and decompression surface. Supporting issue reports show specific parser weaknesses such as a **BT-DHT dissector stack overflow via nested structs** and an **FC-SWILS dissector stack overflow via nested zone set objects**, while CVE tracking includes identifiers such as `CVE-2026-5408` and `CVE-2026-5409`. The release notes also reference additional non-CVE defects involving memory corruption, integer underflow, heap overflow, parser overflows, and stability problems in **Sharkd**, underscoring that malformed capture data or imported content could crash analysis workflows and, in some cases, potentially lead to code execution.
Aug 21, 2026
Wireshark disclosed and patched a broad set of vulnerabilities across its packet analysis engine, protocol dissectors, codecs, decompression routines, and the `sharkd` backend, with the most serious issues including possible code execution, memory corruption, and denial of service. The release notes for **Wireshark 4.6.6** aggregate advisories `wnpa-sec-2026-08` through `wnpa-sec-2026-50`, while earlier coordinated fixes shipped in **4.6.5** and **4.4.15** for affected `4.6.0-4.6.4` and `4.4.0-4.4.14` branches. One high-severity flaw, tracked as **CVE-2026-5656**, allowed a crafted configuration-profile ZIP to escape the intended extraction path and plant a Lua plugin for execution on the next launch. Additional issues included crashes and memory-safety bugs in AMR-NB (`CVE-2026-5654`), iLBC (`CVE-2026-5657`), ASN.1 PER (`CVE-2026-6527`), DCP-ETSI (`CVE-2026-5653`, `CVE-2026-6530`), and later `sharkd` and Bluetooth AVRCP flaws that could crash the process or potentially enable control-flow hijack. Several vulnerabilities were reachable simply by opening a malicious packet capture or by parsing malformed traffic on the wire. Wireshark documented infinite-loop and CPU-exhaustion conditions in the USB HID dissector (**CVE-2026-6534**), OpenFlow v5 dissector (**CVE-2026-6521**), and LZ77 decompression path (**CVE-2026-6533**), alongside crashes in BEEP (**CVE-2026-6538**) and other protocol handlers. GitLab issue reports show researchers and fuzzing jobs repeatedly triggering heap overflows, double-free conditions, NULL dereferences, and non-advancing-offset parser failures in components such as DCP-ETSI, H.245, MIH, eDonkey, and `sharkd`, underscoring that malformed captures can destabilize both the GUI and `tshark`. Wireshark said it was not aware of active exploitation at disclosure time and urged users to update to the fixed releases.
Aug 21, 2026