CVE-2026-125406— Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling

Quick assessment

Affected

Ettercap ettercap

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ettercap 0.8.4.1 及以下版本在文件中的 Telnet 解析器（dissector）存在栈缓冲区下溢漏洞。该漏洞源于在遇到退格符（backspace）时，解析器会递减输出指针，却未进行下界检查。攻击者可构造包含退格符数量多于前导字符数量的 Telnet 数据流，从而将数据写入栈缓冲区下方，导致以 root 权限运行的 Ettercap 进程的栈被破坏。

CVSS 8.8 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling

Source: CVE Program / CVE List V5

Vulnerability Description

Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

缓冲区下溢

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Ettercap	ettercap	0 ~ 0.8.4.1	-

II. Public POCs for CVE-2026-125406

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125406

请登录查看更多情报信息。

Other References for CVE-2026-125406 (5)

https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c#L150-L159 technical-description
https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98 patch
https://github.com/Ettercap/ettercap/pull/1330 issue-tracking patch
https://github.com/Ettercap/ettercap/security/advisories/GHSA-w5ch-7c4x-crcc vendor-advisory
https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-stack-buffer-underwrite-via-telnet-dissector-backspace-handling third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125406

Same Patch Batch · Ettercap · 2026-11-09 · 7 CVEs total

CVE-2026-125400	8.8 HIGH	Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
CVE-2026-125401	8.1 HIGH	Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
CVE-2026-125403	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
CVE-2026-125405	8.1 HIGH	Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
CVE-2026-125402	8.1 HIGH	Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
CVE-2026-125404	7.5 HIGH	Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

IV. Related Vulnerabilities

Same product: ettercap

Same vendor: Ettercap

Same weakness: CWE-124