Wireshark 4.6.9 Fixes 19 Security Vulnerabilities

The Wireshark team has released version 4.6.9 of the free network protocol analyzer. It's a maintenance release with no new features, but it fixes 19 security vulnerabilities plus a long list of bugs. Anyone who opens capture files from untrusted sources should update now.

Security fixes

The 19 advisories (wnpa-sec-2026-92 to wnpa-sec-2026-110) cover crashes and memory-safety flaws in these parts of Wireshark:

• Protocol dissectors: ZigBee ZCL, SCTP, IEEE C37.118 Synchrophasor, SPDY, CSN.1, MBIM, USB HID, RF4CE, TIFF, X11, IEEE 802.11, Catapult DCT2000, and the Frame metadissector
• File parsers: TTL, PEAK CAN TRC, Microsoft Network Monitor, and Toshiba capture files
• Other components: the Sharkd utility and profile import

Most of these can be triggered by packets injected onto the network or by a crafted capture file. The usual result is a crash, but memory corruption bugs like these can sometimes lead to worse.

Bug fixes

• DICOM export: a uint32 length overflow could allocate too little memory and overwrite the heap
• Stack buffer overflow in the etwdump extcap when parsing malicious ETL files
• Integer overflows in the LBMC and LoRaWAN dissectors
• NULL-pointer dereferences in PKCS12 decryption
• Heap read access violation when processing DDI counts in FP Hint E-DCH
• Out-of-bounds read in an error path of the display filter engine (DFVM)
• GREASE values are now correctly ignored when calculating JA4 fingerprints

Updated protocol and file support

Protocol dissectors updated in this release include DICOM, F1AP, IEEE 802.11, NBAP, OpenFlow 1.3–1.5, QUIC, RTPS, SMB, SPDY, X11, and ZigBee ZCL, among others. Support for the BLF, Network Monitor, pcapng, PEAK TRC, Toshiba, and TTL file formats was also updated.

Download

Wireshark 4.6.9 is free and open source for Windows, macOS, and Linux.

• Official release notes
• Download page