iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Wireshark 4.6.5 and 4.4.15 fix a block of 19 security advisories, including a profile-import vulnerability that can place a malicious Lua file in Wireshark’s plug-in directory and execute it when the application starts. The fixes also cover crashes, infinite loops and possible code-execution bugs in protocol dissectors, codecs, file parsers and decompression code.
Upgrade if you run Wireshark 4.6.0–4.6.4 or 4.4.0–4.4.14. The original 19-advisory block appears in the 4.6.5 release notes as wnpa-sec-2026-08 through wnpa-sec-2026-26; those notes now list additional advisories through wnpa-sec-2026-50.
What the 19-f flaw announcement means
The “19 security flaws” wording refers to the inclusive advisory range wnpa-sec-2026-08 through wnpa-sec-2026-26 in Wireshark’s 4.6.5 release notes. It is not the complete security history of the release page: later entries, through wnpa-sec-2026-50, add more parser crashes, infinite loops, memory leaks and related defects.
Wireshark is a network-protocol analyzer that processes packet captures and live traffic through many independent dissectors and decoders. A malformed capture, file or protocol message can therefore reach vulnerable parsing code even when a user has not imported a profile.
#1 Best Overall
The profile-import vulnerability is the highest-impact issue
CVE-2026-5656 (wnpa-sec-2026-21)
Wireshark describes this issue as “Profile import crash and possible code execution.” A technical description identifies a ZIP path-traversal, or Zip-Slip, chain combined with Lua auto-execution.
- An attacker prepares a profile archive containing a traversal path such as
../../../plugins/auto-evil.lua. - When the archive is imported, extraction can escape the intended profile directory and write the Lua file into Wireshark’s plug-ins directory.
- On the next Wireshark startup, the application automatically loads the planted Lua plug-in, providing the possible code-execution step.
This is a file-path and application-logic chain rather than a binary memory-corruption exploit. The practical risk is highest when users import profiles obtained from someone else, a forum, a shared repository or an incident-response package without inspecting the archive.
The affected versions are Wireshark 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The fixes are in 4.6.5 and 4.4.15.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
All 19 advisories in the original block
| Advisory | Issue described by Wireshark | CVE |
|---|---|---|
| wnpa-sec-2026-08 | Monero dissector crash | CVE-2026-5409 |
| wnpa-sec-2026-09 | BT-DHT dissector crash | CVE-2026-5408 |
| wnpa-sec-2026-10 | FC-SWILS dissector crash | CVE-2026-5406 |
| wnpa-sec-2026-11 | SMB2 dissector infinite loop | CVE-2026-5407 |
| wnpa-sec-2026-12 | ICMPv6 dissector crash | CVE-2026-5299 |
| wnpa-sec-2026-13 | AFP dissector crash | CVE-2026-5401 |
| wnpa-sec-2026-14 | TLS dissector crash and possible code execution | CVE-2026-5402 |
| wnpa-sec-2026-15 | K12 RF5 file-parser crash | CVE-2026-5404 |
| wnpa-sec-2026-16 | SBC codec crash and possible code execution | CVE-2026-5403 |
| wnpa-sec-2026-17 | RDP dissector crash and possible code execution | CVE-2026-5405 |
| wnpa-sec-2026-18 | AMR-NB codec crash | CVE-2026-5654 |
| wnpa-sec-2026-19 | SDP dissector crash | CVE-2026-5655 |
| wnpa-sec-2026-20 | iLBC audio-codec crash | CVE-2026-5657 |
| wnpa-sec-2026-21 | Profile-import crash and possible code execution | CVE-2026-5656 |
| wnpa-sec-2026-22 | DCP-ETSI protocol-dissector crash | CVE-2026-5653 |
| wnpa-sec-2026-23 | BEEP protocol-dissector crash | CVE-2026-6538 |
| wnpa-sec-2026-24 | ZigBee protocol-dissector crash | CVE-2026-6537 |
| wnpa-sec-2026-25 | DLMS/COSEM protocol-dissector infinite loop | CVE-2026-6536 |
| wnpa-sec-2026-26 | Dissection-engine zlib-decompression crash | CVE-2026-6535 |
Who should update immediately
- Everyone on an affected branch: move from 4.6.0–4.6.4 to 4.6.5 or later, or from 4.4.0–4.4.14 to 4.4.15 or later.
- Profile-heavy workflows: prioritize the update if you import third-party profiles or distribute profiles to other analysts.
- Capture analysts: update even if you never import profiles, because malformed traffic and files can trigger dissector, codec, parser or decompression defects.
- Lua users: treat plug-ins and profile archives as executable-risk input, especially when Lua plug-ins load automatically at startup.
Upgrade and response procedure
- Check the installed Wireshark version in the application’s About dialog or your operating system’s package manager.
- If it is 4.6.0–4.6.4, install 4.6.5 or a newer 4.6.x release. If it is 4.4.0–4.4.14, install 4.4.15 or a newer 4.4.x release.
- Obtain the installer or package through your normal official Wireshark distribution channel, then close running Wireshark instances before replacing the old version.
- Restart Wireshark and verify the new version in the About dialog.
- Review recently imported profiles. Do not import untrusted archives; inspect ZIP contents for paths containing
../or unexpected Lua files. - If a suspicious profile was imported, disconnect the system from sensitive networks, preserve the archive and relevant logs, and have your security team inspect the plug-ins directory and startup behavior before continuing analysis.
Restarting after an unsafe import matters because startup loading is the final stage of the CVE-2026-5656 execution chain. Merely deleting the profile’s visible settings may not remove a Lua file written outside that directory.
Rank #3
Why the fixes matter beyond profiles
The advisory list spans network protocols such as TLS, RDP, SMB2, ZigBee, BEEP and DLMS/COSEM; audio codecs including SBC, AMR-NB and iLBC; specialized file formats; and the zlib decompression path used by the dissection engine. That breadth means exposure depends on what traffic or files an analyst opens, not only on whether profiles are shared.
Crashes can interrupt investigations and create denial-of-service conditions. Infinite loops can consume CPU and make an analysis workstation unresponsive. The advisories marked as possible code execution deserve additional urgency because a malicious input may move beyond availability impact.
Choosing an update target
| Your current workflow | Required action | Additional check |
|---|---|---|
| Wireshark 4.6.0–4.6.4 | Upgrade to 4.6.5 or later | Review third-party profiles and Lua plug-ins |
| Wireshark 4.4.0–4.4.14 | Upgrade to 4.4.15 or later | Review third-party profiles and Lua plug-ins |
| Any supported version used to open untrusted captures | Install the newest available maintenance release | Limit exposure to untrusted packet files until updated |
Optional learning resources
The Wireshark project also provides official training and Certified Analyst certification information for teams that need structured packet-analysis skills. Treat those as education options separate from the security update itself.
Recommended Free Tools
Frequently Asked Questions
Does the 19-flaw count include every issue fixed in Wireshark 4.6.5?
No. It describes advisories wnpa-sec-2026-08 through wnpa-sec-2026-26. The release-notes page now continues through wnpa-sec-2026-50.
Best Value
Can importing a profile execute code without opening a packet capture?
Yes. CVE-2026-5656 involves archive extraction and Lua plug-in loading at startup, so the profile-import workflow itself can create the execution path.
What if my organization must remain on the 4.4 branch?
Use Wireshark 4.4.15 or a later 4.4.x maintenance release rather than staying on 4.4.0–4.4.14.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
