Wireshark 4.6.8 is now available as the latest maintenance update in the stable 4.6 series of the popular open-source network protocol analyzer, delivering security fixes, crash corrections, and improvements to existing protocol dissectors.
Wireshark 4.6.8 addresses over two dozen reported vulnerabilities, many involving crashes in protocol dissectors or capture-file parsers. Affected components include the RDP, SSH, Kerberos, CMS, H.245, Bluetooth ATT, Bluetooth HFP, C12.22, RRC, and X.509IF dissectors, along with crashes in parsers for formats such as pcapng, Endace ERF, Tektronix K12xx, Catapult DCT2000, BUSMASTER, and 3GPP phone logs.
Several additional bugs have been resolved. These include a segmentation fault triggered when toggling the “Analyze TCP sequence numbers” preference, a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in the BLF writer when handling truncated VLAN-tagged Ethernet frames, and a stack exhaustion issue caused by deeply nested NetLog JSON data. Wireshark also fixes multiple decoding problems affecting 5G NAS information elements.
Protocol support sees updates across a broad range of existing dissectors, including ANSI TCAP, ASN.1 BER, ASTERIX, Bluetooth ATT and AVRCP, CMS, COSEM, GTPv2, Kerberos, KNX/IP, NAS-5GS, Rlogin, RRC, SSH, and several X.509-related protocols. There are no newly supported protocols in Wireshark 4.6.8.
Capture-file handling has been updated for 3GPP phone logs, BLF, BUSMASTER, Catapult DCT2000, Daintree SNA, Endace ERF, Gammu DCT3, pcapng, RTPDump, Sniffer, Tektronix K12xx, and TTTech Computertechnik TTL files. However, the developers note there is no new or updated general file-format decoding support in this release.
Moreover, the release notes clarify a packaging change that took effect with Wireshark 4.6 but was not previously documented. On Unix-like systems, except macOS applications using the official app bundle, extcap helper binaries are now searched for under the libexec directory by default, such as /usr/libexec/wireshark/extcap.
Finally, third-party extcap packages may need to adjust their installation paths, although the location can still be overridden using the WIRESHARK_EXTCAP_DIR environment variable.
For additional details, see the announcement. Wireshark 4.6.8 is now available from the project’s official website for Windows, macOS, and source-based installations. Linux users should monitor their distribution’s repositories for the update.
