Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWireshark 4.6.5 fixes an initial block of 19 security advisories, including CVE-2026-5656 (wnpa-sec-2026-21), a profile-import flaw that can let a crafted ZIP archive place a Lua plugin outside the intended profile directory and execute it when Wireshark starts. Users on Wireshark 4.6.0–4.6.4 or 4.4.0–4.4.14 should upgrade to 4.6.5, 4.4.15, or a later release.
What the 19-fix release covers
Wireshark’s official 4.6.5 release notes list advisories wnpa-sec-2026-08 through wnpa-sec-2026-26. That inclusive range contains 19 entries and is the basis for the “19 security flaws” description. The same release page now includes additional advisories through wnpa-sec-2026-50, so the complete current notes cover more than the original 19-item block.
As an Amazon Associate I earn from qualifying purchases.
The issues affect several parts of Wireshark: protocol dissectors, audio codecs, file-format parsers and the dissection engine. Most are described as crashes or infinite loops; several also carry a possible code-execution impact. This matters particularly to analysts who open untrusted packet captures or imported configuration data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The profile-import vulnerability
How CVE-2026-5656 works
wnpa-sec-2026-21, CVE-2026-5656, is listed as “Profile import crash and possible code execution.” A technical description identifies a ZIP path-traversal (Zip-Slip) condition chained to Lua auto-execution. A malicious profile archive can include a traversal entry such as ../../../plugins/auto-evil.lua. During extraction, the entry can escape the intended profile directory and write a Lua file into Wireshark’s plugins directory.
#1 Best Overall
The next Wireshark startup can automatically load that planted Lua plugin. In other words, the attack is a file-path and startup-loading logic chain; it does not depend on a binary memory-corruption exploit. Importing a profile is the file-writing step, and restarting Wireshark is part of the described execution chain.
Versions affected and fixed
| Branch | Affected versions | Fixed version |
|---|---|---|
| 4.6.x | 4.6.0 through 4.6.4 | 4.6.5 |
| 4.4.x | 4.4.0 through 4.4.14 | 4.4.15 |
Install the fixed release for your branch or a later version. If your organization maintains a different packaged build, use the vendor’s update channel after confirming that it contains the corresponding Wireshark fix.
The 19 advisories in the initial block
| Advisory | Issue | CVE |
|---|---|---|
| wnpa-sec-2026-08 | Monero dissector crash | CVE-2026-5409 |
| wnpa-sec-2026-09 | BT-DHT dissector crash | CVE-2026-5408 |
| wnpa-sec-2026-10 | FC-SWILS dissector crash | CVE-2026-5406 |
| wnpa-sec-2026-11 | SMB2 dissector infinite loop | CVE-2026-5407 |
| wnpa-sec-2026-12 | ICMPv6 dissector crash | CVE-2026-5299 |
| wnpa-sec-2026-13 | AFP dissector crash | CVE-2026-5401 |
| wnpa-sec-2026-14 | TLS dissector crash and possible code execution | CVE-2026-5402 |
| wnpa-sec-2026-15 | K12 RF5 file parser crash | CVE-2026-5404 |
| wnpa-sec-2026-16 | SBC codec crash and possible code execution | CVE-2026-5403 |
| wnpa-sec-2026-17 | RDP dissector crash and possible code execution | CVE-2026-5405 |
| wnpa-sec-2026-18 | AMR-NB codec crash | CVE-2026-5654 |
| wnpa-sec-2026-19 | SDP dissector crash | CVE-2026-5655 |
| wnpa-sec-2026-20 | iLBC audio codec crash | CVE-2026-5657 |
| wnpa-sec-2026-21 | Profile import crash and possible code execution | CVE-2026-5656 |
| wnpa-sec-2026-22 | DCP-ETSI protocol dissector crash | CVE-2026-5653 |
| wnpa-sec-2026-23 | BEEP protocol dissector crash | CVE-2026-6538 |
| wnpa-sec-2026-24 | ZigBee protocol dissector crash | CVE-2026-6537 |
| wnpa-sec-2026-25 | DLMS/COSEM protocol dissector infinite loop | CVE-2026-6536 |
| wnpa-sec-2026-26 | Dissection-engine zlib decompression crash | CVE-2026-6535 |
The release notes continue with wnpa-sec-2026-27 through wnpa-sec-2026-50, describing further infinite loops, crashes, memory leaks and parser problems. Therefore, treating 4.6.5 as fixing only 19 total issues understates the current set of documented fixes.
What Wireshark users should do
- Check your installed version. Open Wireshark’s About dialog or run the installed program’s version command, then determine whether it is in the affected 4.6.0–4.6.4 or 4.4.0–4.4.14 ranges.
- Upgrade. Move to Wireshark 4.6.5 or 4.4.15, or to a later release supplied through the official Wireshark distribution channel.
- Stop importing untrusted profiles until patched. Treat profile archives as potentially executable input, not as harmless preferences.
- Review recent profile imports. If an untrusted archive was imported on an affected build, preserve relevant files for incident review and avoid restarting that installation until it has been updated and checked.
- Restart only after updating. Because startup loading completes the Lua-plugin execution chain, update first, then restart the patched application.
- Keep capture-handling workflows patched. Even users who never import profiles can encounter the dissector, codec, parser or decompression issues when opening untrusted capture files.
How to prioritize remediation
| Your workflow | Priority | Reason |
|---|---|---|
| Imports third-party profiles | Immediate | Direct exposure to the profile path-traversal and Lua-loading chain. |
| Opens captures from outside your organization | Immediate | The 19 advisories include vulnerable dissectors, codecs, parsers and decompression logic. |
| Uses Lua plugins or automatic plugin loading | Immediate | A planted Lua file can be loaded during startup. |
| Uses Wireshark only with trusted, internally generated captures | High | Several fixes still address crashes and infinite loops triggered during dissection. |
Organizations should also verify that software-management systems have replaced older binaries on analyst workstations, jump hosts and forensic images. Updating one workstation does not protect another system that still opens the same untrusted capture or profile.
Rank #3
Why the release matters beyond profile imports
The profile issue is the clearest code-execution concern, but it is not the only reason to update. Wireshark automatically interprets many protocol and media structures while dissecting a capture. A malformed packet can therefore reach code in a protocol dissector, codec or decompression path even when the user performs no explicit import action. Crashes can interrupt investigations, while infinite loops can consume analyst time or tie up shared analysis systems.
Wireshark describes itself as the world’s most popular network protocol analyzer. Its broad use means patching should be part of the normal capture-analysis process, especially on systems used for incident response, malware analysis or evidence handling.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Training and documentation
The Wireshark project provides official documentation, training and Certified Analyst certification information for users who need deeper guidance on capture analysis and secure operational practice. Treat those resources as optional learning material after patching; they do not replace installing the fixed software.
Recommended Free Tools
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
