Wireshark 4.6.9 Fixes 19 Vulnerabilities, Including Possible Code Execution

Wireshark 4.6.9 fixes 19 security vulnerabilities across protocol dissectors, file parsers and related components. The update includes multiple crash, infinite-loop and memory-handling issues, along with one configuration-profile vulnerability that Wireshark says could potentially execute arbitrary code.

The Wireshark Foundation released Wireshark 4.6.9 on September 23, 2026, alongside Wireshark 4.4.19 for the older stable branch. The project recommends that users running vulnerable versions upgrade to the patched releases.

Wireshark 4.6.9 Fixes 19 Vulnerabilities

According to the official Wireshark 4.6.9 release notes, the release fixes 19 security advisories affecting protocol dissectors, file parsers and supporting components.

The affected areas include ZigBee ZCL, SCTP, TTL file parsing, PEAK CAN TRC parsing, IEEE C37.118, SPDY, Microsoft Network Monitor, MBIM, USB HID, RF4CE, TIFF, X11, IEEE 802.11 and other components.

Wireshark’s official security advisories page confirms that these issues were fixed in version 4.6.9, with many also addressed in Wireshark 4.4.19.

CVE-2026-96419 Can Potentially Execute Arbitrary Code

One of the most notable vulnerabilities in the release is CVE-2026-96419, tracked by Wireshark as wnpa-sec-2026-106.

According to the official Wireshark advisory, importing a specially crafted configuration profile could cause Wireshark to crash or potentially execute arbitrary code.

The vulnerability affects Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. It is fixed in Wireshark 4.6.9 and 4.4.19.

Wireshark states that it is not aware of active exploitation of CVE-2026-96419 at the time of the advisory.

Security Issues Fixed in Wireshark 4.6.9

Malformed Packets and Capture Files Can Trigger Several Flaws

Most of the vulnerabilities fixed in Wireshark 4.6.9 are denial-of-service or resource-consumption issues. Depending on the affected component, a malformed packet, capture file or other crafted input may cause Wireshark to crash, consume memory or enter an excessive processing loop.

This matters because Wireshark is frequently used to inspect data captured from untrusted or already compromised systems. Security analysts, SOC teams and incident responders may therefore process attacker-controlled network traffic during routine investigations.

The profile-import vulnerability is different from many of the other issues because it can potentially lead to arbitrary code execution rather than only a crash or denial of service.

Which Wireshark Versions Are Affected?

The exact affected versions differ by advisory, but the new fixes primarily cover Wireshark’s 4.6 and 4.4 release branches.

• Current stable branch: Upgrade to Wireshark 4.6.9 or later.
• Older stable branch: Upgrade to Wireshark 4.4.19 or later where supported.

For example, CVE-2026-96419 affects versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, according to the official advisory.

Administrators should review the individual Wireshark security advisories when validating a specific deployment because affected version ranges can vary between vulnerabilities.

Why Wireshark 4.6.9 Matters for SOC and Network Teams

Wireshark is widely used on security analyst workstations, incident-response endpoints and network engineering systems. That creates a particular security concern: the same application used to investigate malicious traffic can itself become exposed when processing attacker-controlled packets, capture files or configuration data.

Organizations that routinely receive packet captures from customers, third parties or potentially compromised environments should treat those files as untrusted input.

The Wireshark Foundation also noted in its release announcement that the large number of vulnerabilities in this release is related to a recent increase in AI-assisted vulnerability reports.

What Administrators Should Do

• Upgrade Wireshark 4.6 deployments to version 4.6.9 or later.
• Upgrade supported Wireshark 4.4 deployments to version 4.4.19 or later.
• Avoid importing configuration profiles received from untrusted sources.
• Treat packet captures and trace files from unknown or compromised systems as potentially hostile.
• Prioritize updates on SOC, incident-response and network-analysis workstations.
• Review the official advisory for each vulnerability if a specific affected version or component needs to be validated.

The latest official installers are available from the Wireshark download page.

Wireshark 4.6.9 and Enterprise Vulnerability Management

The release is a good example of why security tools themselves must remain inside an organization’s patch-management process. Network analyzers, forensic utilities and incident-response applications often process hostile or malformed data and should not be treated as low-risk desktop software.

For broader enterprise vulnerability tracking, see the CyberUpdates365 CVE & Vulnerability Exploits hub.

You can also review our coverage of Citrix NetScaler CVE-2026-8452 and the F5 BIG-IP CVE-2026-94127 vulnerability for other recent enterprise security issues.

Security Summary

Wireshark 4.6.9 is an important security update that fixes 19 vulnerabilities affecting protocol dissectors, file parsers and related components. Most of the documented issues involve crashes, loops or memory-handling problems, while CVE-2026-96419 stands out because a crafted configuration profile may potentially execute arbitrary code.

Wireshark says it is unaware of exploitation of CVE-2026-96419. Even so, organizations that rely on Wireshark for network troubleshooting, security analysis or incident response should update to the latest supported release and avoid processing untrusted profiles on vulnerable versions.

Official Sources

• Wireshark 4.6.9 and 4.4.19 Release Announcement
• Wireshark 4.6.9 Official Release Notes
• Wireshark Security Advisories
• wnpa-sec-2026-106 / CVE-2026-96419 Advisory
• Official Wireshark Download Page