CVE-2026-125401— Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector

Quick assessment

Affected

Ettercap ettercap

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ettercap 0.8.4.1 及更早版本在文件的函数中存在堆缓冲区溢出漏洞。该漏洞会将多达 44 字节的数据写入一个仅分配了 30 字节的缓冲区。远程攻击者可通过被监控的网络，向 TCP 8074 端口发送经过篡改版本字段的 Gadu-Gadu 流量，从而破坏以 root 身份运行的 Ettercap 进程的堆内存。

CVSS 8.1 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector

Source: CVE Program / CVE List V5

Vulnerability Description

Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Ettercap	ettercap	0 ~ 0.8.4.1	-

II. Public POCs for CVE-2026-125401

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125401

请登录查看更多情报信息。

Other References for CVE-2026-125401 (5)

https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_gg.c#L599 technical-description
https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98 patch
https://github.com/Ettercap/ettercap/pull/1330 issue-tracking patch
https://github.com/Ettercap/ettercap/security/advisories/GHSA-vrjv-f8gv-2h35 vendor-advisory
https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-buffer-overflow-via-gadu-gadu-dissector third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125401

Same Patch Batch · Ettercap · 2026-11-09 · 7 CVEs total

CVE-2026-125406	8.8 HIGH	Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
CVE-2026-125400	8.8 HIGH	Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
CVE-2026-125403	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
CVE-2026-125405	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
CVE-2026-125402	8.1 HIGH	Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
CVE-2026-125404	7.5 HIGH	Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

IV. Related Vulnerabilities

Same product: ettercap

Same vendor: Ettercap

Same weakness: CWE-122