Wireshark 4.6.8 released, addressing 28 vulnerabilities

The SANS Internet Storm Center reports that Wireshark version 4.6.8 has been released, addressing 28 vulnerabilities and 25 bugs. Wireshark is widely used network protocol analyser software, commonly deployed by security teams, network engineers, and IT operations staff for troubleshooting, monitoring, and forensic analysis. The vulnerabilities addressed in this release include issues that could allow an attacker to crash the application or potentially execute arbitrary code by sending specially crafted network traffic or by convincing a user to open a malicious packet capture file. While Wireshark is typically used in controlled environments, the software is often run with elevated privileges and has access to sensitive network traffic, making it a potential target for attackers.

Why this matters for UK organisations

This release is a practical reminder that security and network analysis tools require the same patch discipline as any other software. Wireshark is commonly used across IT and security teams, and outdated versions can introduce risk, particularly if analysts are opening packet capture files from untrusted sources or analysing traffic from potentially hostile networks. The vulnerabilities addressed in this release could allow an attacker to disrupt analysis activity, compromise the analyst's workstation, or potentially gain access to sensitive network traffic data. For UK organisations, this is a prompt to review whether Wireshark is kept up to date across security and network teams, and whether users are aware of the risks associated with opening packet capture files from untrusted sources.

What to review

UK organisations using Wireshark should update to version 4.6.8 across all security and network teams. Review whether the software is kept current as part of routine patch management processes, and whether users are aware of the risks associated with opening packet capture files from untrusted sources. Consider whether Wireshark is run in a controlled environment with appropriate access controls, and whether analysts are trained to handle potentially malicious network traffic safely. Ensure that ownership of vulnerability management for security tools is clear, and that regular reviews of software versions and patch status are part of routine security practice.

Source: SANS Internet Storm Center