The SANS ISC diary notes that Wireshark 4.6.6 has been released, fixing one vulnerability and 11 bugs. For Windows users, the bundled packet capture driver Npcap has also been updated to version 1.88. Since Wireshark is widely used by network, SOC, forensic, and troubleshooting teams, keeping it updated matters more than people usually admit while staring proudly at packet captures like digital detectives.

This update is especially important because packet analysis tools often process untrusted traffic captures. A malformed packet capture file or crafted traffic sample can sometimes trigger parser vulnerabilities, making tools used for investigation part of the attack surface. In other words, even the tool used to inspect suspicious traffic must not be blindly trusted, because the universe enjoys practical jokes with CVEs attached. 

Organizations should update Wireshark to 4.6.6, especially on analyst workstations, lab systems, incident response machines, and any endpoint used to open third-party packet captures. Windows teams should also verify that Npcap 1.88 is installed after the update. Security tools, admin utilities, and forensic applications should be included in patch management, not treated as harmless because “only IT uses them.” 

The larger lesson is simple: defensive tools need maintenance too. Attackers do not care whether software is used by end users, developers, admins, or analysts. If it parses files, handles network data, or runs with elevated privileges, it belongs in the vulnerability management program. Tools that help defend the network should not quietly become another weak point inside it.

Wireshark release 4.6.6 fixes 1 vulnerability and 11 bugs.

Source: Wireshark 4.6.6 Released, (Sun, May 24th) via SANS Internet Storm Center — published 24 May 2026.