Wireshark 4.6.8 drops with 31 security patches, targeting malformed capture files and the Bluetooth stack
The largest single-release security batch in the program's history also lands on the 4.4.18 LTS branch.
Wireshark 4.6.8 is here, and it is a security-focused push that addresses 31 vulnerabilities. If you run the world's most popular network protocol analyzer, this one should be your first action item. The Wireshark Foundation released the patch alongside version 4.4.18, meaning long-term support users aren't left behind. Every single advisory in this batch is classified as a crash or abnormal exit. None of them appear to grant remote code execution on their own, but that classification matters less than the attack vector. A crafted capture file hitting one of these dissectors is a one-way ticket to a terminated process.
File parsers and the Bluetooth stack take the hit
Over half the fixes target file parsers. We are looking at malformed pcapng traces, ERF dumps, Vector BLF logs, Catapult DCT2000 exports, and just about any binary format someone has ever forced through the open dialog. The more obscure the trace format, the more likely it got fuzzed and patched. If you've been opening network captures from third-party vendors or field testers, the risk wasn't theoretical. It was just waiting for the right malformed payload.
The Bluetooth stack landed four separate patches in a single release. Dissectors for BT ATT, AVRCP, BR/EDR FHS, and the HFP Profile all received crash hardening. On top of that, five telecom and 5G protocols got cleaned up. The RRC protocol, UMTS FP, and several 5G NAS information elements that were previously decoding incorrectly all received fixes. It's a pretty clear signal that mobile and IoT network analysis is becoming a primary use case for the tool.
sharkd, memory safety, and a Linux path change
Maybe the most operationally relevant fix targets sharkd. Two separate advisories clean up crash conditions in the daemon's network-facing API. If you run Wireshark's remote analysis service on a server, you've just removed two more ways for it to go sideways. The release also patches a stack buffer overflow in the K12/RF5 writer, an out-of-bounds read in the BLF writer, and finally kills a bug that caused File Capture Properties to hang on Windows since version 4.6.6.
Keep in mind that Wireshark's fuzzing infrastructure keeps finding trouble. A randpkt-generated file actually triggered a crash in this cycle, and the team quietly patched a deep recursion bypass in the DLMS/COSEM TypeDescription parser that could have exhausted the stack. It's not exactly a sign of a fragile codebase. It's a sign that the automated testing pipeline is doing exactly what it's supposed to do.
Linux users should note a quiet packaging change. extcap binaries now live under libexec by default instead of the old /usr/lib64 path. The change follows the FHS convention and has been live since 4.6.0, but it wasn't explicitly documented until the release notes dropped. Third-party extcap packages will need to update their install locations. The long wait for that documentation is over.
It's a heavy release. Wireshark 4.6.5 shipped 26 advisories, and this one clocks in at 31. However, at the same time, the frequency shows the project's hardening effort is accelerating rather than degrading. Head here to grab the official binaries at wireshark.org. The 4.4.18 patch sits right next to it for anyone still on the legacy branch. If you rely on this tool for daily traffic analysis, the update window is narrow.
Head to the official Wireshark download page to grab 4.6.8.
