CVE-2026-125400— Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

Quick assessment

Affected

Ettercap ettercap

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ettercap 0.8.4.1 及更早版本在中的函数存在释放后使用（use-after-free）漏洞。该漏洞会在释放匹配数据后，继续读取 PCRE2 的 ovector（输出向量）。邻近网络的攻击者可发送与已加载的替换过滤器相匹配的数据包，从而破坏内存，并可能以 root 权限执行任意代码。

CVSS 8.8 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

Source: CVE Program / CVE List V5

Vulnerability Description

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Ettercap	ettercap	0 ~ 0.8.4.1	-

II. Public POCs for CVE-2026-125400

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125400

请登录查看更多情报信息。

Other References for CVE-2026-125400 (5)

https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_filter.c#L593-L625 technical-description
https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98 patch
https://github.com/Ettercap/ettercap/pull/1330 issue-tracking patch
https://github.com/Ettercap/ettercap/security/advisories/GHSA-f3j5-rhhr-85j5 vendor-advisory
https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-use-after-free-via-pcre2-filter-substitution third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125400

Same Patch Batch · Ettercap · 2026-11-09 · 7 CVEs total

CVE-2026-125406	8.8 HIGH	Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
CVE-2026-125401	8.1 HIGH	Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
CVE-2026-125403	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
CVE-2026-125405	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
CVE-2026-125402	8.1 HIGH	Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
CVE-2026-125404	7.5 HIGH	Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

IV. Related Vulnerabilities

Same product: ettercap

Same vendor: Ettercap

Same weakness: CWE-416