Wireshark 4.6.7

What's new in this version:

Fixed:
The following vulnerabilities have been fixed:
- wnpa-sec-2026-52 Catapult DCT2000 protocol dissector crash
- wnpa-sec-2026-53 pcapng file parser crash
- wnpa-sec-2026-54 FMP/NOTIFY protocol dissector large loop
- wnpa-sec-2026-55 SSH protocol dissector crash
- wnpa-sec-2026-56 TLS ECH decryption crash
- wnpa-sec-2026-57 IEEE 802.11 protocol dissector crash
- wnpa-sec-2026-58 Z39.50 protocol dissector crash
- wnpa-sec-2026-59 UMTS FP protocol dissector crash
- wnpa-sec-2026-60 BLF file parser information disclosure
- wnpa-sec-2026-61 Multiple protocol dissector infinite loops
- wnpa-sec-2026-62 DBS Etherwatch file parser crash
- wnpa-sec-2026-63 Ciscodump extcap crash

The following bugs have been fixed:
- Wireshark appears in German when the system language is Dutch
- Qt: Capture filter combo box does not enforce minimum size or expanding size policy
- BACapp: Error parsing you-are request
- Use-After-Free in Ethernet POWERLINK (EPL) Dissector during profile loading error path
- Sponsor slides are not properly shown
- Buffer overlow/segfault in Catapult DCT2000 dissector via not check no_ddi_entries in header
- Fuzz job issue: fuzz-2026-05-24-14517548985.pcap
- Fuzz job UTF-8 encoding issue: fuzz-2026-06-07-14732586286.pcap
- Memory leak in alp-sample1.pcap
- Memory leak in nspi.pcap
- Heap-Buffer-Overflow in Wireshark Logcat Parser
- IPv6 Ping from Debian (among others) is dissected as "HiPerConTracer" Issue 21349.
- HEVC (H.265) dissector: bit_offset not advanced after sub_layer_hrd_parameters() causes false Malformed Packet
- dfilter_compile_full: heap-buffer-overflow READ in ws_strptime on a time literal
- Wireshark crashes with a HEAP_CORRUPTION error when using the last saved recent_common file
- Fuzz job issue: fuzz-2026-06-30-15106674620.pcap

New and Updated Features:
- The Windows installers are now built with Visual Studio 2026

Updated Protocol Support:
- ALC, BACapp, C2P, Catapult DCT2000, COTP, CSN.1, DCERPC, DCERPC MAPI, DCERPC NSPI, DNS, DVB-S2-TABLE, eDonkey, EPL, FC ELS, FMP/NOTIFY, H.265, HiPerConTracer, IEEE 802.11, LLS, MEGACO, MIH, MPEG DSM-CC, MS-WSP, RELOAD, SGP.32, SSH, STANAG 4607, UMTS FP, WOWW, and Z39.50

New and Updated Capture File Support:
- Android Logcat, BLF, DBS Etherwatch, Netlog, and pcapng

Plugin Development Changes:
- On UN*X systems (excluding macOS when running from an app bundle, as with the official installer) extcap binaries are now searched for under the libexec directory by default, e.g., /usr/libexec/wireshark/extcap instead of /usr/lib64/wireshark/extcap or similar. This is the customary place for helper binaries, which as opposed to libraries do not need multiarch support. The location can be overridden via the environment variable WIRESHARK_EXTCAP_DIR. The extcap binaries shipped with Wireshark are installed in the new location, but third party extcaps may need packaging changes. This change was effective in version 4.6.0, but was not explicitly noted in the release notes previously. Note that some distributions do not use a libexec directory, such as Alpine Linux, which does not have multilib support. On such systems extcap binaries should be in the same location as before.