Wireshark version 4.6.8 has been released, addressing a total of 28 security vulnerabilities within the popular network protocol analyzer. Nine of these critical flaws are located in file parsers, meaning they can be triggered simply by opening a specially crafted capture file without any network interaction.
The affected file parsers include pcapng, Endace ERF, Tektronix K12xx, BUSMASTER, Catapult DCT2000, Gammu DCT3, 3gpp phone logs, TTX Logger, and, specifically on Windows systems, Ixia IxVeriWave and Vector Informatik BLF. These vulnerabilities are tracked under advisories ranging from wnpa-sec-2026-64 to wnpa-sec-2026-91.
The majority of the remaining fixes target dissectors, which are the components responsible for interpreting raw packet data into human-readable fields. Crashes were resolved in dissectors for protocols such as RDP, SSH, Kerberos, H.245, ESS, X.509IF, RRC, and UMTS FP. Additionally, two separate advisories address issues in CMS and C12.22, while four advisories cover vulnerabilities in Bluetooth ATT, HFP, BR/EDR FHS, and AVRCP.
One vulnerability was also patched in the reassembly engine, a core component utilized by all dissectors to reconstruct fragmented data. Two other fixes specifically address crashes in `sharkd`, the command-line utility, extending exposure to any scripts or applications built upon it. Several of these fixes were identified through the project's internal fuzzing efforts.
Beyond the formally numbered advisories, the release also includes several memory-safety fixes. These include a stack buffer overflow in the K12/RF5 writer, a stack over-read in the Sniffer REC_HEADER2 error path, an out-of-bounds read in `androiddump` related to a signed `btsnoop` length, an out-of-bounds read in the BLF writer when processing truncated VLAN-tagged frames, and stack exhaustion issues stemming from deeply nested NetLog JSON and recursion in the DLMS/COSEM compact-array parser.
In addition to security patches, version 4.6.8 corrects several decoding errors in 5G NAS and 5GSM protocols. Specifically, Wireshark was found to be misdecoding the S-NSSAI location validity information, NSAG information, UE security capability, Registration wait range, and Extended CAG information elements in 5G NAS. In 5GSM, the SOR transparent container, its SOR-CMCI field, and the service level AA container were also incorrectly interpreted. These issues did not cause crashes but presented inaccurate data to users.
For UN*X systems, a change in the default search path for `extcap` binaries, which took effect in version 4.6.0, is now documented in the release notes. Wireshark now looks for these binaries under `/usr/libexec/wireshark/extcap` instead of older paths like `/usr/lib64/wireshark/extcap`. Third-party `extcap` implementations may require packaging adjustments, though the `WIRESHARK_EXTCAP_DIR` environment variable can override this location. Distributions without a `libexec` directory, such as Alpine Linux, will continue to use the previous path.
Windows users will also benefit from two nuisance fixes. A performance issue that could cause the application to hang when accessing Capture File Properties, present since version 4.6.6, has been resolved. Additionally, toggling the TCP preference "Analyze TCP sequence numbers" no longer results in a segmentation fault.
