The latest Wireshark 4.6.7 maintenance release addresses twelve security vulnerabilities that could affect users analyzing network traffic. Since packet captures processed in Wireshark pass through numerous protocol dissectors, malformed packets or capture files can trigger unexpected software behavior. The update strengthens security by fixing issues across several protocol parsers, including Catapult DCT2000, SSH, IEEE 802.11, and other components involved in packet analysis.
Wireshark Secur
The latest Wireshark 4.6.7 maintenance release addresses twelve security vulnerabilities that could affect users analyzing network traffic. Since packet captures processed in Wireshark pass through numerous protocol dissectors, malformed packets or capture files can trigger unexpected software behavior. The update strengthens security by fixing issues across several protocol parsers, including Catapult DCT2000, SSH, IEEE 802.11, and other components involved in packet analysis.
Most of the twelve patched vulnerabilities involve software crashes caused by crafted packets or capture files. These flaws could force protocol dissectors to read beyond allocated memory or access invalid memory locations, causing Wireshark to terminate unexpectedly.The affected components include dissectors for Catapult DCT2000, SSH, IEEE 802.11, Z39.50, and UMTS FP. Security updates also cover the pcapng capture file reader and the DBS Etherwatch file parser, reducing risks when opening specially crafted capture files.Some vulnerabilities functioned differently from memory-related crashes. The FMP/NOTIFY dissector could enter a lengthy processing loop when handling specific inputs, while another advisory grouped several dissectors capable of becoming stuck in infinite loops. Additionally, the BLF file parser contained an information disclosure issue that could expose data beyond the intended memory boundaries in decoded output. Separate crash vulnerabilities were also resolved in the TLS ECH decryption path and the CiscoDump extcap helper.
Additional Bug Fixes Improve Wireshark Stability
Alongside the security updates, Wireshark 4.6.7 resolves sixteen non-security bugs affecting stability and usability.One significant fix addresses a use-after-free issue in the Ethernet POWERLINK dissector that occurred during a profile-loading error. Another eliminates a heap-buffer-overflow in the Android Logcat parser.The release also resolves several user-facing issues. Systems configured for Dutch were incorrectly displaying the Wireshark interface in German. An IPv6 ping generated by Debian and some other operating systems was mistakenly identified as HiPerConTracer traffic.Developers also corrected a problem in the HEVC video dissector, where certain packets were incorrectly marked as malformed due to an improper bit offset advancement. Another fix prevents heap corruption that could crash the application when loading the most recent saved recent_common file.
Updated extcap Binary Location for Plugin Developers
The release also documents a packaging change introduced in Wireshark 4.6.0 that was previously left out of the official release notes. On UNIX-like systems, Wireshark now searches for extcap helper binaries in the libexec directory by default, such as /usr/libexec/wireshark/extcap. This location aligns with the standard placement for helper executables that do not require the multiarch handling used for shared libraries.The bundled extcap utilities already use the updated directory, although third-party extcap packages may require adjustments to remain compatible. Developers can override the default search path by setting the WIRESHARK_EXTCAP_DIR environment variable. The documentation also notes that distributions without a libexec directory, including Alpine Linux, will continue using the previous binary location.
The Wireshark Foundation has released Wireshark 4.6.6, delivering an important round of security and stability updates that address a serious Dissector Crash vulnerability tied to the ROHC protocol parser, along with a separate global-buffer-overflow flaw affecting MACsec traffic analysis. The release focuses heavily on improving reliability for users handling untrusted packet captures and production monitoring environments.
At the center of the update is a security issue identified as wnpa-
The Wireshark Foundation has released Wireshark 4.6.6, delivering an important round of security and stability updates that address a serious Dissector Crash vulnerability tied to the ROHC protocol parser, along with a separate global-buffer-overflow flaw affecting MACsec traffic analysis. The release focuses heavily on improving reliability for users handling untrusted packet captures and production monitoring environments.At the center of the update is a security issue identified as wnpa-sec-2026-51, tracked internally as Issue 21243. The flaw involved Wireshark’s ROHC (Robust Header Compression) dissector, the component responsible for decoding compressed IP packet headers during network analysis. According to the release notes, attackers could exploit the weakness by injecting a malformed packet into a live traffic capture or by supplying a crafted .pcap file. Successful exploitation could trigger a Dissector Crash, interrupting packet analysis sessions and potentially affecting operational monitoring systems.
The ROHC Vulnerability
The newly patched ROHC vulnerability emerged during fuzz testing campaigns conducted in May 2026. Researchers found that malformed packet injection could destabilize the protocol parser, exposing weaknesses in how Wireshark processed specific ROHC packet sequences. Because Wireshark is commonly used in enterprise monitoring, forensic investigations, and protocol debugging, the risk associated with a remotely triggered Dissector Crash raised concerns for security teams working with external or untrusted traffic captures.In addition to the ROHC issue, developers also fixed a MACsec dissector global-buffer-overflow vulnerability tracked as Issue 21235. The flaw created a memory safety risk while parsing IEEE 802.1AE-secured traffic. The global-buffer-overflow condition was also identified through fuzz testing and represented another example of how malformed network traffic could affect protocol dissectors inside Wireshark.
Wireshark 4.6.6 Introduces Stability and Windows Compatibility Fixes
The Wireshark 4.6.6 release includes several other significant fixes aimed primarily at improving Windows compatibility and application stability. One major correction resolved a Windows crash affecting Visual Studio environments, documented under Work Item 24787. Developers also fixed uninitialized memory reads in both the pntoh16 and find_signature functions within the VeriWave (vwr) file reader, tracked under Issues 16460 and 16461.Another high-profile issue involved compatibility problems introduced in Wireshark 4.6.5. Users reported that the software failed to run correctly on Windows 10 version 1809, Windows Server 2019, and certain Long-Term Servicing Channel (LTSC) editions. The regression, listed as Issue 21237, has now been resolved in the latest release.The update also corrects an installation problem on Windows systems where optional features could be accidentally removed during upgrades if users did not explicitly preserve them. That issue was tracked as Issue 18925. Developers further addressed a packaging problem that caused Wireshark.exe version 4.6.5 to become nearly twice the size of version 4.6.4. The oversized executable issue, documented as Issue 21233, has now been fixed.Two additional fuzz testing crashes discovered in May 2026 capture files, tracked as Issues 21240 and 21253, were also resolved as part of the release. These fixes collectively strengthen Wireshark’s resilience against malformed packet processing and parser instability.Wireshark 4.6.6 now ships with Npcap 1.88, replacing the previously bundled Npcap 1.87 release. The updated packet capture library is intended to improve low-level packet capture reliability on Windows platforms. Although no entirely new protocols were introduced in this version, dissector support received updates for several technologies, including BACapp, MACsec, ROHC, Kafka, SIP, PFCP, and BPv7. Capture file handling improvements also extend to JSON and VeriWave formats.On Unix-based systems, extcap binaries now default to the /usr/libexec/wireshark/extcap directory. While this behavior was originally introduced in Wireshark 4.6.0, the change has now been formally documented as part of the 4.6.6 release cycle.
Entrar
Firewall Daily – The Cyber Express
