CVE-2026-125401
Received Received - Intake

Heap Buffer Overflow in Ettercap

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125401
EUVD
EUVD-2026-120564

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Ettercap ettercap From 0 (inc) to 0.8.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ettercap versions up to 0.8.4.1 have a heap buffer overflow in the gg_get_version() function. This flaw allows attackers to send specially crafted Gadu-Gadu traffic on TCP port 8074 through a monitored network. The crafted version field can write up to 44 bytes into a buffer allocated for only 30 bytes, causing heap memory corruption in the Ettercap process, which typically runs with root privileges.

Detection Guidance

Detect this vulnerability by monitoring network traffic on TCP port 8074 for Gadu-Gadu protocol. Inspect Ettercap logs for crashes or heap corruption errors. Use tools like tcpdump or Wireshark to capture and analyze traffic on port 8074 for malformed version fields.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute arbitrary code on the system running Ettercap. Since Ettercap runs as root, successful exploitation may lead to full system compromise, allowing attackers to gain control over the affected machine, steal data, or perform other malicious activities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using vulnerable Ettercap versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches resulting from this flaw.

Mitigation Strategies

Immediately update Ettercap to the latest version beyond 0.8.4.1. Block or restrict TCP port 8074 traffic at the firewall level. Disable Ettercap's Gadu-Gadu dissector if not needed. Monitor systems for unusual activity or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...