Wireshark 4.6.9 is now available as the latest maintenance update to the 4.6 series of the popular open-source network protocol analyzer.
The release addresses 19 disclosed vulnerabilities, most of which involve crashes in various protocol dissectors and file parsers. Among the affected components are ZigBee ZCL, SCTP, SPDY, CSN.1, MBIM, X11, IEEE 802.11, RF4CE, and Catapult DCT2000.
However, several issues go beyond crashes. The TTL file parser and TIFF dissector could enter infinite loops. The IEEE C37.118 Synchrophasor dissector suffered from a memory leak. A USB HID issue could cause both an infinite loop and a memory leak.
The most notable fix concerns Wireshark’s profile import functionality. According to the developers, a vulnerability tracked as CVE-2026-96419 could cause a crash and potentially allow code execution. Sharkd, Wireshark’s daemon-based analysis utility, also received a fix for a separate crash vulnerability.
Beyond the 19 listed security advisories, Wireshark 4.6.9 fixes a substantial collection of bugs. These include integer-overflow issues affecting Bluetooth AVCTP multipart reassembly and SMB object export, a stack-based buffer overflow when parsing crafted ETL files through the etwdump extcap utility, and problems involving DICOM object exports and LoRaWAN decryption.
Other fixes address a NULL-pointer dereference in PKCS12 handling, an out-of-bounds read in DFVM, F1AP decoding problems, and an issue where Wireshark failed to ignore GREASE values when calculating JA4 fingerprints.
On the protocol side, the update refreshes support for a broad range of technologies, including IEEE 802.11, QUIC, SMB, OpenFlow 1.3 through 1.5, ZigBee ZCL, LoRaWAN, X11, SPDY, RTPS, DICOM, and Bluetooth AVCTP. There are no newly supported protocols in this release.
Capture file handling has also been updated for BLF, Network Monitor, pcapng, PEAK TRC, Toshiba, and TTL formats.
Finally, the developers clarified that since Wireshark 4.6.0, extcap helpers on Linux and other UNIX-like systems are searched under libexec by default, such as /usr/libexec/wireshark/extcap, which may require adjustments in third-party packages.
For more information about all fixes included in Wireshark 4.6.9, refer to the official release notes.
