Wireshark 4.6.9 Fixes 19 Security Vulnerabilities, Including a Profile Import Flaw

Wireshark has released version 4.6.9, a maintenance update that fixes 19 security vulnerabilities affecting its protocol dissectors, file parsers, and supporting utilities.

The release notes list issues involving crashes, infinite loops, memory leaks, and other defects that can affect the stability of network traffic analysis and file processing.

One of the listed vulnerabilities concerns profile importing and carries a warning about possible code execution. Other fixes address problems in protocol components such as ZigBee ZCL, SCTP, SPDY, IEEE 802.11, and USB HID.

The update also includes a separate set of bug fixes covering memory handling, integer overflows, buffer access, protocol decoding, and capture-file processing.

Wireshark is a widely used network protocol analyzer for troubleshooting, network analysis, software development, and education. Its protocol dissectors interpret network traffic, while its file parsers process supported capture and trace formats.

The 4.6.9 release focuses on correcting defects in these components. The release notes do not provide a consolidated severity rating or CVSS score for the 19 vulnerabilities.

Wireshark 4.6.9: Security Vulnerabilities at a Glance

The release notes identify 19 security issues, numbered wnpa-sec-2026-92 through wnpa-sec-2026-110.

The vulnerabilities affect protocol dissectors, file parsers, and the Sharkd utility.

All 19 Security Vulnerabilities Fixed in Version 4.6.9

The following table summarizes the security issues listed in the official release notes.

The release notes do not specify CVSS scores, exploitation status, or detailed attack prerequisites for these vulnerabilities.

Profile Import Vulnerability Includes Possible Code Execution

One of the security issues in Wireshark 4.6.9 concerns profile importing.

The release notes identify the issue as:

• Advisory: wnpa-sec-2026-106

• CVE: CVE-2026-96419

• Component: Profile import

• Reported impact: Crash and possible code execution

• Issue tracker: Issue 21553

The release notes do not provide additional technical details about the conditions required for code execution, the attack vector, or whether exploitation has been observed.

The issue is one of 19 security vulnerabilities addressed in the update.

Infinite Loops and Memory Issues Affect Multiple Components

Several vulnerabilities involve components that can enter infinite loops or experience memory-related problems.

Infinite-loop vulnerabilities

The release fixes infinite-loop issues affecting:

• TTL file parser: CVE-2026-95386

• USB HID dissector: CVE-2026-96421

• TIFF dissector: CVE-2026-96418

The Microsoft Network Monitor file parser also has a reported large-loop issue under CVE-2026-95394.

Memory-related vulnerability

The IEEE C37.118 Synchrophasor protocol dissector had a reported memory leak under CVE-2026-95395.

The USB HID dissector's issue combines an infinite loop with a memory leak.

The release notes do not disclose the precise resource consumption, triggering conditions, or operational impact of these individual issues.

Additional Bug Fixes Beyond the Security Advisories

Wireshark 4.6.9 also includes fixes for bugs that are listed separately from the 19 security advisories.

These changes address several classes of defects.

Memory safety and integer-handling issues

The release notes include fixes for:

• DICOM Export Objects length wrapping that caused undersized allocation and heap overwrite.

• DICOM AT value formatting that caused quadratic packet-scope memory amplification.

• Integer overflow in LBMC fragment reassembly.

• Numeric truncation in LoRaWAN decryption.

• Integer overflow in Bluetooth AVCTP multipart reassembly.

• Out-of-bounds reading in the DFVM binary-operation error path.

• Out-of-bounds reading in SMB Object Export.

• Stack-based buffer overflow in the etwdump external capture utility when parsing crafted ETL files.

• A NULL-pointer dereference in PKCS#12 PBE decryption.

• An uninitialized buffer pointer issue in AKP EncryptedData parsing.

The release notes also list additional corrections to protocol decoding and parsing.

Protocol decoding and analysis fixes

Other fixes include:

• Correcting F1AP notification information decoding.

• Fixing RTPS data-batch minimum-length validation.

• Correcting JA4 handling of GREASE values.

• Fixing F1AP RRC release message decoding.

• Addressing an FP Hint E-DCH DDI count handling issue.

• Fixing a UTF-8 encoding issue found in a fuzzing job.

These changes cover both protocol interpretation and the handling of malformed or unusual input.

Protocol and Capture-File Support Updates

Wireshark 4.6.9 does not introduce support for any new protocols.

The release updates existing protocol support across the following areas:

Updated protocols include:

AKP, Bencode, BSSLAP, Bluetooth AVCTP, Catapult DCT2000, CSN.1, DICOM, F1AP, FP Hint, Frame, GNW, GSM BSSMAP, IEEE 802.11, LBMC, LoRaWAN, NBAP, OBEX, OpenFlow 1.3, OpenFlow 1.4, OpenFlow 1.5, PKCS12, QUIC, RTPS, SGP.32, SMB, SPDY, Synchrophasor, UMTS FP, X11, and ZigBee ZCL.

The release also updates capture-file support for:

• BLF

• Microsoft Network Monitor

• pcapng

• PEAK TRC

• Toshiba

• TTL

The release notes state that there is no new or updated file-format decoding support in this version.

Plugin Development Change: External Capture Utilities on Unix

The release notes also describe a change involving external capture (extcap) utilities on Unix-like systems.

On Unix systems, excluding macOS when running from an application bundle, Wireshark now searches for extcap binaries under the libexec directory by default.

An example location is:

/usr/libexec/wireshark/extcap

Previously, these binaries could be located under paths such as:

/usr/lib64/wireshark/extcap

The default location can be overridden using the WIRESHARK_EXTCAP_DIR environment variable.

The release notes clarify that this behavior took effect in Wireshark 4.6.0 but was not explicitly documented in the release notes at that time.

Third-party extcap packages may require packaging changes. Some distributions, including Alpine Linux, do not use a libexec directory and should retain their previous locations.

What Users and Administrators Should Know

Wireshark 4.6.9 addresses multiple security issues across protocol analysis, file parsing, and supporting utilities.

Users should review the official release notes and obtain the appropriate installation package from the Wireshark download page.

Organizations that distribute Wireshark through operating-system package managers should check the package version supplied by their distribution.

The release notes do not provide a consolidated severity assessment, a list of affected versions for each vulnerability, or a separate workaround for systems that cannot immediately update.

Conclusion

Wireshark 4.6.9 addresses 19 security vulnerabilities, including issues involving protocol dissector crashes, infinite loops, memory leaks, and a profile import flaw with possible code execution.

The update also includes additional fixes for memory handling, integer overflows, buffer access, protocol decoding, and capture-file processing.

Although the release does not introduce new protocol support, it updates existing protocol and capture-file handling components and documents an extcap binary location change for Unix systems.

For users and administrators, the next step is to review the official release notes and obtain the appropriate package for their environment.