Wireshark 4.6.8 addresses 28 security vulnerabilities in the network protocol analyzer, with nine of the flaws affecting file parsers that process saved capture data. These issues allow an attacker to trigger a crash or execute code simply by providing a malicious file, removing the need to interact with the network itself. The affected parsers cover formats like pcapng, Endace ERF, Tektronix K12xx, BUSMASTER, and several proprietary logging standards. Attackers exploit these flaws when a user opens a capture file, bypassing network security entirely to compromise the local system.
Most fixes target dissectors, which convert raw network bytes into readable fields. Developers patched crashes in protocols including RDP, SSH, Kerberos, and Bluetooth components. Two separate advisories cover CMS and C12.22, while four address Bluetooth ATT, HFP, BR/EDR FHS, and AVRCP. One vulnerability exists in the reassembly engine used to stitch fragmented data. Two crashes impact the command-line utility sharkd, potentially exposing scripted tools to malicious input. The previous version, 4.6.7, contained 12 advisories, suggesting the increased number reflects broader testing efforts rather than a sudden spike in new vulnerabilities.
Decoding errors in 5G data
Beyond crashes, Wireshark 4.6.8 corrects misdecoding of 5G fields in NAS and 5GSM signaling. The analyzer incorrectly displayed the S-NSSAI location validity information, NSAG information, UE security capability, Registration wait range, and Extended CAG information elements. The SOR transparent container, its SOR-CMCI field, and the service level AA container were also decoded wrong. This type of failure presents a significant risk because the user interface presents the incorrect data without warning, leading an engineer to trust faulty information during network analysis.
Related: AI spots hidden tampering in industrial devices
Administrators managing capture files should prioritize updating the software immediately to close these entry points. The release notes for version 4.6.0 moved the extcap path on UN*X systems to /usr/libexec/wireshark/extcap, a change that affects third-party tools and requires packaging adjustments for distributions like Alpine Linux. Windows users face a capture file properties performance issue that has caused the application to hang since version 4.6.6, along with a crash when toggling the TCP preference for sequence number analysis. These fixes address both the silent corruption of data and the stability of the application’s core utilities.
Several memory-safety issues exist without formal advisory numbers, including a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in androiddump from a signed btsnoop length, and a stack exhaustion caused by deeply nested NetLog JSON. These bugs complicate the counting of total risk, as the advisory system captures only a fraction of the potential exploits. A stack over-read was also fixed in the Sniffer REC_HEADER2 error path. The BLF writer contained an out-of-bounds read triggered by truncated VLAN-tagged frames.
