Wireshark 4.4.9 Released With Critical Bug Fixes and Protocol Updates

The Wireshark Foundation today announced the release of Wireshark 4.4.9, a maintenance update that brings critical stability improvements and updates to its protocol dissectors, published on 2 September 2025. According to Wireshark, the update fixes a vulnerability in the SSH dissector (tracked as wnpa-sec-2025-03 and internally logged as Issue 20642) that could crash the application when parsing certain malformed packets.

In addition to SSH hardening, the release resolves six other decoder flaws affecting enterprise and academic users, including corrections to the RDM Product Detail List ID parsing (Issue 20612), SCCP LUDT segmentation (Issue 20647), Cisco IOS capture initialization (Issue 20655), visibility of closing context tag 1 in BACnet WritePropertyMultiple operations (Issue 20665), and a 32‑bit length field in an LZ77 decompression error (Issue 20671).

No new capture file formats were added, though the updater ships with improved dissector logic for BACapp, LIN, MySQL, RDM, SABP, SCCP, sFlow and SSH, enhancing decoding accuracy and resilience during analysis. Wireshark 4.4.9 is available for Windows, macOS, and major Linux distributions, with users on 4.4.x urged to upgrade promptly; full details are in the official release notes at wireshark[.]org/docs/relnotes/wireshark-4.4.9.html.