# Wireshark 4.6.4 Patch Fixes Dissector Vulnerabilities — Update Guide > Wireshark 4.6.4 addresses multiple dissector vulnerabilities, including CVE-2025-1811 and CVE-2025-1812, which could lead to application crashes. - Published: 2026-03-02T12:20:02.000Z - Severity: medium - Category: Vulnerabilities - Tags: CVE-2025-1811, CVE-2025-1812, CVE-2025-1813, Wireshark, Network Security - Author: Runtime Rebel Intel - Primary source: https://isc.sans.edu/diary/rss/32758 - Canonical: https://runtimerebel.com/blog/wireshark-4-6-4-patch-fixes-dissector-vulnerabilities-update-guide ## Key points - Immediate impact: Security analysts face application crashes or potential denial of service when processing malicious packet captures. - Affected systems: Systems running Wireshark versions prior to 4.6.4 are susceptible to these dissector vulnerabilities. - Remediation: Update all installations to Wireshark 4.6.4 or later to resolve the identified security flaws. ## Overview of the Wireshark 4.6.4 Security Release Wireshark, the industry-standard network protocol analyzer, has officially released version 4.6.4 to address several security flaws and functional bugs. According to [SANS ISC](https://isc.sans.edu/diary/rss/32758), this update specifically resolves three [CVE](/glossary#cve) entries and 15 general software bugs. While Wireshark is a diagnostic tool, vulnerabilities within its dissector engine represent a significant risk to the [SOC](/glossary#soc) and threat intelligence community. Attackers can leverage malformed packets to trigger application crashes, effectively conducting a denial-of-service attack against the analyst's machine. ## Technical Analysis of Dissector Vulnerabilities The primary concern in this release involves vulnerabilities within specific protocol dissectors. Dissectors are the components responsible for parsing and interpreting packet data. When a dissector fails to properly validate input, it can lead to memory exhaustion, infinite loops, or segmentation faults. ### IEEE 802.15.4 and RSVP Dissector Risks The most notable fixes in this cycle involve the IEEE 802.15.4 and RSVP dissectors. [CVE-2025-1811](https://nvd.nist.gov/vuln/detail/CVE-2025-1811) identifies a crash in the IEEE 802.15.4 dissector, which is commonly used for low-rate wireless personal area networks. Similarly, [CVE-2025-1812](https://nvd.nist.gov/vuln/detail/CVE-2025-1812) addresses a crash in the Resource Reservation Protocol (RSVP) dissector. For security professionals, understanding the **Wireshark protocol analyzer security update** is essential because these tools often run with elevated privileges or handle untrusted data from potentially compromised network segments. If an analyst captures live traffic containing specially crafted packets, the application may terminate unexpectedly, hindering incident response efforts. In more severe (though less common) scenarios, dissector flaws can be a precursor to [RCE](/glossary#rce), although the current disclosures focus on stability and denial of service. ### USB Dissector and Bug Fixes In addition to network protocols, [CVE-2025-1813](https://nvd.nist.gov/vuln/detail/CVE-2025-1813) addresses a crash in the USB dissector. As forensic analysts frequently use Wireshark to examine USB traffic (USBPcap), this flaw could be exploited via a malicious peripheral or a captured traffic file. Beyond the security fixes, the release addresses 15 functional bugs that improved the accuracy of protocol decoding, which is vital for maintaining the integrity of data sent to a [SIEM](/glossary#siem) or other analysis platforms. ## How to Patch Wireshark 4.6.4 Dissector Vulnerabilities Defenders should prioritize the update on all workstations used for network forensics and live traffic monitoring. The most effective **CVE-2025-1811 mitigation steps** involve transitioning to the latest stable branch. Unlike server-side software, Wireshark is often installed on local endpoints, making version control more challenging for large teams. 1. **Inventory Check**: Identify all systems running Wireshark versions 4.6.0 through 4.6.3. 2. **Deployment**: Use centralized management tools to push the 4.6.4 installer. For Linux environments, ensure repositories are updated to fetch the latest builds. 3. **Verification**: Confirm that the installation is successful by checking the version string in the 'About Wireshark' menu. ## Impact on Threat Intelligence and Operations From a [MITRE ATT&CK](/glossary#mitre-att-ck) perspective, targeting an analyst's tools can be seen as a form of anti-forensics. By triggering a crash in the protocol analyzer, a threat actor can mask their [C2](/glossary#c2) traffic or [Lateral Movement](/glossary#lateral-movement) during a live investigation. While these vulnerabilities are not currently listed as being exploited in the wild, the public availability of the patch details often leads to the development of proof-of-concept scripts. Professionals should follow this **Wireshark protocol analyzer security update** closely, as any delay in patching provides a window for attackers to disrupt investigative workflows. Ensuring that forensic tools are as secure as the environments they monitor is a fundamental tenet of a [Zero Trust](/glossary#zero-trust) architecture. Organizations should treat Wireshark as a critical piece of the security stack and include it in regular [EDR](/glossary#edr) and vulnerability scanning schedules to identify outdated versions that may harbor known [IoC](/glossary#ioc) or exploit triggers. **Related:** [AI-Automated Campaign Targets Global FortiGate Edge Infrastructure](/blog/ai-automated-campaign-targets-global-fortigate-edge-infrastructure), [Critical Cisco SD-WAN Zero-Day Exploited Since 2023](/blog/critical-cisco-sd-wan-zero-day-exploited-since-2023) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/wireshark-4-6-4-patch-fixes-dissector-vulnerabilities-update-guide