Wireshark CVE-2026-6520

Upgrade to patched versions: Wireshark 4.6.5 or later to remediate the 4.6.x branch, or Wireshark 4.4.15 or later to remediate the 4.4.x branch. Complete update details and additional patched versions are available at https://www.wireshark.org/security/wnpa-sec-2026-40.html. Until patching is feasible, apply the following compensating controls with trade-offs: (1) Restrict Wireshark usage to trusted or pre-filtered packet capture files only, avoiding analysis of live untrusted network traffic - this eliminates the attack vector if malicious packets cannot reach Wireshark but reduces detection capability for inline monitoring. (2) Disable or remove the OpenFlow v6 dissector plugin if SDN protocol analysis is not required - this eliminates the vulnerable code path but sacrifices OpenFlow protocol visibility. (3) Run Wireshark in a sandboxed or isolated environment (virtual machine, container) so that denial of service impacts only the analysis environment, not production systems - this mitigates availability impact but adds operational overhead. (4) Implement input validation at the packet capture source, filtering out malformed OpenFlow frames before they reach Wireshark - this requires network-level access and signature-based filtering, which may be difficult if OpenFlow variants are poorly documented. The vendor-supplied patch is the most reliable remediation.