Download Wireshark

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.9 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.9

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.8 --exact

Bug Fixes The following vulnerabilities have been fixed: - wnpa-sec-2026-64 sharkd crash. Issue 21395. - wnpa-sec-2026-65 sharkd crash. Issue 21399. - wnpa-sec-2026-66 UMTS FP protocol dissector crash. Issue 21413. - wnpa-sec-2026-67 RDP protocol dissector crash. Issue 21396. - wnpa-sec-2026-68 TTX Logger file parser crash. Issue 21389. - wnpa-sec-2026-69 Dissection engine reassembly crash. Issue 21423. - wnpa-sec-2026-70 BUSMASTER file parser abnormal exit. Issue 21435. - wnpa-sec-2026-71 Tektronix K12xx file parser crash. Issue 21414. - wnpa-sec-2026-72 ERF file parser crash. Issue 21415. - wnpa-sec-2026-73 Bluetooth Attribute Protocol dissector crash. Issue 21424. - wnpa-sec-2026-74 Catapult DCT2000 file parser crash. Issue 21427. - wnpa-sec-2026-75 C12.22 protocol dissector crash. Issue 21439. - wnpa-sec-2026-76 CMS protocol dissector crash. Issue 21446. - wnpa-sec-2026-77 H.245 protocol dissector crash. Issue 21447. - wnpa-sec-2026-78 Kerberos protocol dissector crash. Issue 21449. - wnpa-sec-2026-79 Bluetooth HFP Profile protocol dissector crash. Issue 21451. - wnpa-sec-2026-80 Bluetooth BR/EDR FHS protocol dissector crash. Issue 21452. - wnpa-sec-2026-81 3gpp phone log file parser crash. Issue 21454. - wnpa-sec-2026-82 Ixia IxVeriWave and Vector Informatik BLF file parser crashes on Windows. Issue 21455. - wnpa-sec-2026-83 CMS protocol dissector crash. Issue 21457, Issue 21458. - wnpa-sec-2026-84 Pcapng file parser crash. Issue 21460. - wnpa-sec-2026-85 SSH protocol…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.8

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.7 --exact

Bug Fixes The following vulnerabilities have been fixed: - wnpa-sec-2026-52 Catapult DCT2000 protocol dissector crash. Issue 21270. - wnpa-sec-2026-53 pcapng file parser crash. Issue 21285. - wnpa-sec-2026-54 FMP/NOTIFY protocol dissector large loop. Issue 21347. - wnpa-sec-2026-55 SSH protocol dissector crash. Issue 21378. - wnpa-sec-2026-56 TLS ECH decryption crash. Issue 21390. - wnpa-sec-2026-57 IEEE 802.11 protocol dissector crash. Issue 21391. - wnpa-sec-2026-58 Z39.50 protocol dissector crash. Issue 21397. - wnpa-sec-2026-59 UMTS FP protocol dissector crash. Issue 21398. - wnpa-sec-2026-60 BLF file parser information disclosure. Issue 21361. - wnpa-sec-2026-61 Multiple protocol dissector infinite loops. Issue 21275, Issue 21277, Issue 21330, Issue 21383. - wnpa-sec-2026-62 DBS Etherwatch file parser crash. Issue 21352. - wnpa-sec-2026-63 Ciscodump extcap crash. Issue 21375. The following bugs have been fixed: - Wireshark appears in German when the system language is Dutch. Issue 20347. - Qt: Capture filter combo box does not enforce minimum size or expanding size policy. Issue 21080. - BACapp: Error parsing you-are request. Issue 21260. - Use-After-Free in Ethernet POWERLINK (EPL) Dissector during profile loading error path. Issue 21267. - Sponsor slides are not properly shown. Issue 21268. - Buffer overlow/segfault in Catapult DCT2000 dissector via not check no_ddi_entries in header. Issue 21270. - Fuzz job issue: fuzz-2026-05-24-14517548985.pcap. Issue 21272…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.7

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.6 --exact

Bug Fixes The following vulnerabilities have been fixed: - wnpa-sec-2026-51 ROHC protocol dissector crash. Issue 21243. The following bugs have been fixed: - Wireshark crashes when run under Visual Studio on Windows. Work item 24787. - Welcome page slide preferences are now available in the preferences window. - vwr: Read of uninitialized memory in pntoh16. Issue 16460. - vwr: Read of uninitialized memory in find_signature. Issue 16461. - Upgrades on Windows do not retain existing optional features unless explicitly requested, resulting in accidental removal of features. Issue 18925. - Wireshark.exe version 4.6.5 is twice as large as version 4.6.4. Issue 21233. - MACsec dissector global-buffer-overflow. Issue 21235. - Wireshark 4.6.5 does not run on Windows 10 version 1809 (including Server 2019 and some LTSC versions) Issue 21237. - Fuzz job issue: fuzz-2026-05-02-14184750352.pcap. Issue 21240. - packet-bacapp: rename aurth-request to auth-request. Issue 21246. - Fuzz job issue: randpkt-2026-05-10-14293434231.pcap. Issue 21253. New and Updated Features - The Windows installers now ship with Npcap 1.88. They previously shipped with Npcap 1.87. New Protocol Support There are no new protocols in this release. Updated Protocol Support BACapp, BPv7, DB/IB GDS DB, Kafka, MACsec, PFCP, RF4CE, ROHC, RTPS-VT, SAPHDB, and SIP New and Updated Capture File Support JSON and VeriWave New and Updated File Format Decoding Support There is no new or updated file format support in this…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.6

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.5 --exact

Bug Fixes This release fixes quite a few vulnerabilities. This is due to to a recent trend in AI-assisted vulnerability reports. - wnpa-sec-2026-08 Monero dissector crash. Issue 21066. CVE-2026-5409. - wnpa-sec-2026-09 BT-DHT dissector crash. Issue 21067. CVE-2026-5408. - wnpa-sec-2026-10 FC-SWILS dissector crash. Issue 21070. CVE-2026-5406. - wnpa-sec-2026-11 SMB2 dissector infinite loop. Issue 21073. CVE-2026-5407. - wnpa-sec-2026-12 ICMPv6 dissector crash. Issue 21077. CVE-2026-5299. - wnpa-sec-2026-13 AFP dissector crash. Issue 21088. CVE-2026-5401. - wnpa-sec-2026-14 TLS dissector crash and possible code execution. Issue 21090. CVE-2026-5402. - wnpa-sec-2026-15 K12 RF5 file parser crash. Issue 21094. CVE-2026-5404. - wnpa-sec-2026-16 SBC codec crash and possible code execution. Issue 21103. CVE-2026-5403. - wnpa-sec-2026-17 RDP dissector crash and possible code execution. Issue 21105. CVE-2026-5405. - wnpa-sec-2026-18 AMR-NB codec crash. Issue 21111. CVE-2026-5654. - wnpa-sec-2026-19 SDP dissector crash. Issue 2111. CVE-2026-5655. - wnpa-sec-2026-20 iLBC audio codec crash. Issue 21113. CVE-2026-5657. - wnpa-sec-2026-21 Profile import crash and possible code execution. Issue 21115. CVE-2026-5656. - wnpa-sec-2026-22 DCP-ETSI protocol dissector crash. Issue 21122. CVE-2026-5653. - wnpa-sec-2026-23 BEEP protocol dissector crash. Issue 21120. CVE-2026-6538. - wnpa-sec-2026-24 ZigBee protocol dissector crash. Issue 21125. CVE-2026-6537. - wnpa-sec-2026-25 DLMS/COSEM protcol…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.5

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.4 --exact

Bug Fixes - wnpa-sec-2026-05 USB HID dissector memory exhaustion. Issue 20972. CVE-2026-3201. - wnpa-sec-2026-06 NTS-KE dissector crash. Issue 21000. CVE-2026-3202. - wnpa-sec-2026-07 RF4CE Profile dissector crash. Issue 21009. CVE-2026-3203. The following bugs have been fixed: - Wireshark doesn’t start if Npcap is configured with "Restrict Npcap driver’s Access to Administrators only" Issue 20828. - PQC signature algorithm not reported in signature_algorithms. Issue 20953. - Unexpected JA4 ALPN values when space characters sent. Issue 20966. - Expert Info seems to have quadratic performance (gets slower and slower) Issue 20970. - IKEv2 EMERGENCY_CALL_NUMBERS Notify payload cannot be decoded. Issue 20974. - TShark and editcap fails with segmentation fault when output format (-F) set to blf. Issue 20976. - Fuzz job crash: fuzz-2026-02-01-12944805400.pcap [Zigbee Direct Tunneling Zigbee NWK PDUs NULL hash table] Issue 20977. - Wiretap writes pcapng custom options with string values invalidly. Issue 20978. - RDM status in Output Status (GoodOutputB) field incorrectly decoded in Art-Net PollReply dissector. Issue 20980. - Wiretap writes invalid pcapng Darwin option blocks. Issue 20991. - TDS dissector desynchronizes on RPC DATENTYPE (0x28) due to incorrect expectation of TYPE_VARLEN (MaxLen) Issue 21001. - Only first HTTP POST is parsed inside SOCKS with "Decode As". Issue 21006. - TShark: Bogus "Dissector bug" messages generated in pipelines where something after tshark exits…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.4

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.3 --exact

Bug Fixes The following vulnerabilities have been fixed: - wnpa-sec-2026-01 BLF file parser crash. Issue 20880. - wnpa-sec-2026-02 IEEE 802.11 dissector crash. Issue 20939. - wnpa-sec-2026-03 SOME/IP-SD dissector crash. Issue 20945. - wnpa-sec-2026-04 HTTP3 dissector infinite loop. Issue 20944. The following bugs have been fixed: - Wireshark 4.6.0 build fails on Solaris: pcapio.c:441:21: error: request for member '_flag' in something not a structure or union. Issue 20773. - RTP Player streams cannot be stopped. Issue 20879. - Additional ABI/API compatibility fixes. Issue 20881. - Missing data in pinfo→cinfo in HomePlug message CM_ATTEN_CHAR.IND. Issue 20893. - maxmind_db: crash when switching from a profile where it’s disabled to one where it’s enabled. Issue 20903. - Compilation warning or error if CFLAGS defines _FORTIFY_SOURCE to other than 3 without first undefining it. Issue 20904. - IEEE 802.11: Incorrect parsing of QoS and Mesh Control Field when the frame body contains an A-MSDU. Issue 20905. - OSS-Fuzz 473164101: Heap-buffer-overflow in dissect_idn_laser_data. Issue 20936. - Bug in decoding 5G NAS message - Extended CAG information list IE. Issue 20946. New Protocol Support There are no new protocols in this release. Updated Protocol Support DCT2000, DHCP, H.248, H.265, HomePlug AV, HTTP3, IDN, IEEE 802.11, LTE RRC, NAS-5GS, PKCS12, QUIC, RTPS, SOME/IP-SD, SSH, and Thrift New and Updated Capture File Support 3GPP TS 32.423 Trace, BLF, NetScreen, and Viavi Observer…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.3

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.2 --exact

Bug Fixes This release fixes an API/ABI change that was introduced in Wireshark 4.6.1, which caused a compatibility issue with plugins built for Wireshark 4.6.0. Issue 20881. The following vulnerabilities have been fixed: - wnpa-sec-2025-07 HTTP3 dissector crash. Issue 20860. - wnpa-sec-2025-08 MEGACO dissector infinite loop. Issue 20884. The following bugs have been fixed: - ws_base32_decode should be named *_encode ? Issue 20754. - Omnipeek files not working in 4.6.1. Issue 20876. - Stack buffer overflow in wiretap/ber.c (ber_open) Issue 20878. - Plugins incompatibility between 4.6.0 & 4.6.1. Issue 20881. - Fuzz job crash: fuzz-2025-11-30-12266121180.pcap. Issue 20883. New and Updated Features - The Windows installers now ship with the Visual C++ Redistributable version 14.44.35112. They previously shipped with 14.40.33807. New Protocol Support There are no new protocols in this release. Updated Protocol Support ATM PW, COSEM, COTP, DECT NR+, DMP, Fc00, GTP, HTTP3, IEEE 802.15.4, ISIS HELLO, ISOBUS, MAC-LTE, MAUSB, MEGACO, MPEG DSM-CC, OsmoTRXD, PTP, RLC, SAPDIAG, and SMTP New and Updated Capture File Support Peektagged New and Updated File Format Decoding Support There is no new or updated file format support in this release.

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.2

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.1 --exact

Bug Fixes - wnpa-sec-2025-05 BPv7 dissector crash. Issue 20770. - wnpa-sec-2025-06 Kafka dissector crash. Issue 20823. The following bugs have been fixed: - L2CAP dissector doesn’t understand retransmission mode. Issue 2241. - DNS HIP dissector labels PK algorithm as HIT length. Issue 20768. - clang-cl error in "packet-zbee-direct.c" Issue 20776. - Writing to an LZ4-compressed output file might fail. Issue 20779. - endian.h conflics with libc for building plugins. Issue 20786. - TShark crash caused by Lua plugin. Issue 20794. - Wireshark stalls for a few seconds when selecting specific messages. Issue 20797. - TLS Abbreviated Handshake Using New Session Ticket. Issue 20802. - Custom websocket dissector does not run. Issue 20803. - WINREG QueryValue triggers dissector bug in packet-dcerpc.c. Issue 20813. - Lua: FileHandler causing crash when reading packets. Issue 20817. - Apply As Filter for field with FT_NONE and BASE_NONE for a single byte does not use the hex value. Issue 20818. - Layout preference Pane 3 problem with selecting Packet Diagram or None. Issue 20819. - TCP dissector creates invalid packet diagram. Issue 20820. - Too many nested VLAN tags when opening as File Format. Issue 20831. - Omnipeek files not working in 4.6.0. Issue 20842. - Support UTF-16 strings in the IsoBus dissector for the string operations. Issue 20845. - SNMP getBulkRequest request-id does not get filtered for correctly. Issue 20849. - Fuzz job issue: fuzz-2025-11-12-12064814316.pcap. Issue…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.1

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.6.0 --exact

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.6.0

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.9 --exact

Bug Fixes The following bugs have been fixed: - RDM Product Detail List ID Disect incorrect. Issue 20612. - SCCP LUDT segmentation decoding fails. Issue 20647. - Ciscodump fails to start capture on Cisco IOS. Issue 20655. - [BACnet] WritePropertyMultiple closing context tag 1 not showing. Issue 20665. - Bug in LZ77 decoder; reads a 16-bit length when it should read a 32-bit length. Issue 20671. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support BACapp, LIN, MySQL, RDM, SABP, SCCP, sFlow, and SSH New and Updated Capture File Support There is no new or updated capture file support in this release. Updated File Format Decoding Support There is no updated file format support in this release.

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.9

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.8 --exact

Bug Fixes The following bugs have been fixed: - Renegotiated DTLS session is not being decrypted. Issue 20362. - Wireshark is completely stuck in initialization because androiddump recv() is blocked. Issue 20526. - Fuzz job UTF-8 encoding issue: fuzz-2025-06-20-7318.pcap. Issue 20585. - Crash when showing packet in new window after reloading Lua plugins with a certain gui.column.format preference. Issue 20588. - Bug in UDS dissector with Service ReadDataByPeriodicIdentifier Response. Issue 20589. - Packet diagram doesn’t show non-standard field value representations. Issue 20590. - Packet diagram shows representation twice when field type is FT_NONE. Issue 20601. - application/x-www-form-urlencoded key parsed incorrectly following a name-value byte sequence with no '=' Issue 20615. - DNP3 time stamp was unable to work after epoch time(year 2038) Issue 20618. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support ASTERIX, DLT, DNP 3.0, DOF, DTLS, ETSI CAT, Gryphon, IPsec, ISObus VT, KRB5, MBIM, RTCP, SLL, STCSIG, TETRA, UDS, and URL Encoded Form Data New and Updated Capture File Support pcapng Updated File Format Decoding Support There is no updated file format support in this release.

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.8

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.7 --exact

Bug Fixes The following vulnerabilities have been fixed: - wnpa-sec-2025-02 Dissection engine crash. Issue 20509. CVE-2025-5601. The following bugs have been fixed: - Wireshark does not correctly decode LIN "go to sleep" in TECMP and CMP. Issue 20463. - Dissector bug, Protocol CIGI. Issue 20496. - Green power packets are not dissected when proto_version == ZBEE_VERSION_GREEN_POWER. Issue 20497. - Packet diagrams misalign or drop bitfields. Issue 20507. - Corruption when setting heuristic dissector table UI name from Lua. Issue 20523. - LDAP dissector incorrectly displays filters with singleton "&" Issue 20527. - WebSocket per-message compression extentions: fail to decompress server messages (from the 2nd) due to parameter handling. Issue 20531. - The LL_PERIODIC_SYNC_WR_IND packet is not properly dissected (packet-btle.c) Issue 20554. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support AT, BT LE LL, CIGI, genl, LDAP, LIN, Logcat Text, net_dm, netfilter, nvme, SSH, TCPCL, TLS, WebSocket, ZigBee, and ZigBee ZCL New and Updated Capture File Support There is no new or updated capture file support in this release. Updated File Format Decoding Support There is no updated file format support in this release.

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.7

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.6 --exact

Bug Fixes The following bugs have been fixed: - Bug in EtherCAT dissector with ECS order. Issue 13718. - Conversation dialog columns return to default width on each new packet in live capture. Issue 15978. - Tests fail in LTO-enabled builds in Ubuntu/Debian. Issue 18216. - Incorrect conditions in BFCP dissector. Issue 18717. - Static build fails on Ubuntu 24.04 because the c-ares library isn’t found. Issue 20343. - Flutter’s Image Picker Generated JPEG Files Detected as Malformed Packet. Issue 20355. - QUIC dissector breaks when src and dst change. Issue 20371. - s390x: build fail on Ubuntu PPA nighty build. Issue 20372. - Trailing octet after IPv4 packet end is not detected or displayed in raw bytes. Issue 20423. - [packet-ax25-nol3.c] Only call APRS dissector on UI Frames. Issue 20429. - Wireshark hangs when refreshing interfaces with the debug console preference set to "always" and a file open (Windows) Issue 20434. - BGP EVPN - Type-8 route not correctly read after addition of Max. Response Time field. Issue 20459. - Wireshark does not correctly decode LIN "go to sleep" in TECMP and CMP. Issue 20463. - MQTT-SN: WILLTOPIC message not decoded correctly (missing some flags) Issue 20476. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support ADB, ASAM CMP, AX.25, BACapp, BFCP, BGP, CP2179, DCERPC WKSSVC, DCT2000, DECT-NWK, DHCP, DOF, EAPOL-MKA, ECAT, ErlDP, Ethertype, F1AP, GSM BSSMAP, GSM DTAP, HomePlug AV, ICMP…

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.6

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.5 --exact

Bug Fixes The following bugs have been fixed: - GRPC: protobuf_json only displays the truncated string value. Issue 20392. - Wireshark crashes when clicking on a column title/header. Issue 20403. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support GNW, IPv4, NFAPI, and ProtoBuf New and Updated Capture File Support There is no new or updated capture file support in this release. Updated File Format Decoding Support There is no updated file format support in this release.

Release notes

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.5

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.4.3 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.4.3

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.0.10.0 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.0.10.0

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.0.8.0 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.0.8.0

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.0.7.0 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.0.7.0

Pin this version: winget install --id WiresharkFoundation.Wireshark --version 4.0.6.0 --exact

Manifest: manifests/w/WiresharkFoundation/Wireshark/4.0.6.0