Wireshark Patches 28 Vulnerabilities

Overview

The Wireshark Foundation has released Wireshark 4.6.8, a critical security update that addresses 28 vulnerabilities capable of crashing the world’s most widely used network protocol analyzer. For SOCs, network engineers, and developers, patching these flaws is essential to prevent denial-of-service (DoS) conditions during live packet captures or incident response workflows.

Key Vulnerabilities Patched

Tracked under advisories wnpa-sec-2026-64 through wnpa-sec-2026-91, the update fixes crashes across protocol dissectors, file parsers, and core components.

• Enterprise & Security Protocols: RDP, Kerberos, SSH, H.245, CMS, and X.509IF.
• Wireless & Cellular Stack: Bluetooth profiles (ATT, HFP, AVRCP, BR/EDR FHS), UMTS FP, and RRC.
• Industrial & Utilities: C12.22 smart‑metering protocol (appearing twice in advisories).
• File Parsing Components: TTX Logger, BUSMASTER, Tektronix K12xx, Endace ERF, Catapult DCT2000, Gammu DCT3, and 3GPP phone logs.

Improper handling of malformed or malicious packet data was the root cause, allowing attackers to crash Wireshark by injecting crafted traffic or tricking analysts into opening malicious capture files.

Notable Fixes Beyond Crashes

• Buffer & Memory Protection:
  • Stack buffer overflow in K12/RF5 writer.
  • Out‑of‑bounds read in BLF writer.
  • NULL‑pointer dereference in KNXIP Secure Wrapper.
• Recursion Guardrails: Stack exhaustion flaw in deeply nested NetLog JSON payloads.
• 5G Telemetry Accuracy: Corrected decoding logic for NAS information elements.
• UI Performance: Fixed Windows‑specific delays in File Capture Properties dialog.

Operational Impact

Unpatched Wireshark versions risk:

• Unexpected crashes during live packet analysis.
• DoS conditions triggered by malicious traffic or capture files.
• Loss of forensic data during critical investigations.

Advisory wnpa-sec-2026-87 (X.509IF dissector) is pending a CVE identifier, signaling its inclusion in national vulnerability databases.

Defensive Guidance

• Update immediately: Apply Wireshark 4.6.8 to eliminate crash vectors.
• Handle untrusted captures cautiously: Avoid opening files from unknown sources.
• Monitor for abnormal behavior: Watch for unexpected exits or parser errors.
• Follow hardening practices: Limit exposure of Wireshark servers and sharkd daemon.

Expert in the Cloud Insight

Wireshark’s ubiquity makes it a prime target for crafted packet exploits. This release demonstrates how even non‑RCE flaws can disrupt critical workflows. For defenders, the lesson is clear: network analysis tools must be patched as aggressively as operating systems and browsers, because a crash during incident response can mean losing visibility when it matters most.