Wireshark 4.6.1: patch your DFIR workstations—two dissector crash bugs fixed

Wireshark 4.6.1 and 4.4.11 shipped on November 19, 2025 with fixes for two dissector crash issues; installers for Windows and macOS plus source are available now (Wireshark news). The patched issues are BPv7 (Bundle Protocol v7) and Kafka dissectors that could crash when parsing crafted traffic or trace files (wnpa-sec-2025-05, wnpa-sec-2025-06). Wireshark notes discovery during internal testing and no known in-the-wild exploitation, but a crash during triage still means lost analyst time and potentially missed signal (BPv7 advisory, Kafka advisory). The 4.6.1 release is also the first maintenance for the 4.6 branch (4.6.1 release notes).

Intrusion Flow

• Delivery path: adversary-controlled traffic is captured live or shared as a PCAP/PCAPNG. When the vulnerable dissector analyzes the bytes, Wireshark (or TShark) can crash, creating a denial-of-service condition for the analyst (BPv7 advisory impact, Kafka advisory impact).
• Tool surface: TShark uses the same packet dissection code as Wireshark, so headless workflows are equally exposed until patched (tshark(1) manual).
• Versions affected: BPv7 crash affects 4.6.0; Kafka crash affects 4.6.0 and 4.4.0-4.4.10; fixes are in 4.6.1 and 4.4.11 (wnpa-sec-2025-05, wnpa-sec-2025-06). A CVE was issued for the Kafka issue as CVE-2025-13499 (Tenable summary).

Key Artifacts to Pull

• The suspect capture(s): preserve the original file that triggered instability. Don’t re-open in a vulnerable build; make a sanitized copy with dissectors disabled or targeted filtering (examples below) (tshark(1)).
• Temp capture remnants: Wireshark’s capture helper uses OS temp paths; check the user temp directory (e.g., %LOCALAPPDATA%\Temp on Windows) for partial or ringbuffer files if a crash occurred (User’s Guide: Windows temporary folder).
• Profile and folders record: About → Folders lists where preferences, plugins, and temp data live for the current install; screenshot or export for your case record (User’s Guide: File locations via About → Folders).

Detection Notes

• Inventory versions quickly:
  • GUI: Help → About, or CLI: wireshark -v / tshark -v (wireshark(1), tshark(1)).
• Screen inbound PCAPs for impacted protocols before opening in an unpatched environment:
  • Count hits: tshark -r sample.pcapng -q -Y "kafka || bpv7" -c 1 (exits non-zero only if no packets match) (tshark display filtering).
• Validate protocol names on your build if you plan to disable them: tshark -G protocols | grep -Ei "kafka|bpv7" (tshark(1)).

Response Guidance

1. Patch priority and branches

• Update Wireshark to 4.6.1 (4.6 branch) or 4.4.11 (4.4 branch). Official installers and source are live as of November 19, 2025 (Wireshark news; BPv7 fix; Kafka fix).

2. Harden PCAP handling until patched

• Disable specific dissectors during read to reduce risk exposure:
  • Example: tshark --disable-protocol kafka --disable-protocol bpv7 -r incoming.pcapng -w sanitized.pcapng (Command-line protocol control, tshark(1)).
• Create filtered copies that exclude the risky protocols, then analyze the copy:
  • Example: tshark -r incoming.pcapng -Y "not kafka and not bpv7" -w safe_subset.pcapng (tshark display filter and write).
  • Or remove specific packet ranges with editcap if you’ve identified offending frames: editcap -r incoming.pcapng cleaned.pcapng 1000-2000 (editcap(1)).
• If you rely on third-party Lua plugins, consider disabling Lua temporarily to reduce crash surface: set enable_lua = false in init.lua (re-enable after patching) (Wireshark Developer’s Guide: Lua control). Release notes also mention a TShark crash scenario involving Lua in this cycle, reinforcing caution (4.6.1 update details).

3. Windows capture driver note

• Wireshark no longer supports WinPcap; use Npcap on Windows, and uninstall WinPcap if present (4.6.x notes).

Takeaways

• Upgrade Wireshark now to 4.6.1 (or 4.4.11) to eliminate the BPv7 and Kafka crash vectors (news, BPv7, Kafka).
• Treat untrusted PCAPs as hazardous inputs until patched; disable at-risk dissectors or pre-filter captures before deep analysis (tshark(1)).
• Confirm your fleet’s versions and sanitize queued captures; then re-enable normal workflows. If you operate on Windows, ensure you’re on Npcap, not WinPcap (4.6.1 notes).