What is the fix for CVE-2026-125400?

No released version yet (advisory: patched versions none). Fix is merged to master in commit 1d8badb713579419a29a494bb463a1af59707e98 (PR #1330); build from master after that commit, or stop loading pcre_regex() substitution filters until a release.

Post Share

HIGH8.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

ETTERCAP · CVE-2026-125400 · Package

Ettercap: use-after-free in filter code lets network attackers run code as root

Q: Who is not affected by CVE-2026-125400?

Not affected if: no-ettercap-installed, no-filters, no-pcre-regex-filter, not-on-attacker-network, pcre1-build, unoffensive-mode.

NO FIX YET · SEE WHAT TO DO

Ettercap through 0.8.4.1 reads freed PCRE2 match data in its filter code (func_pcre in src/ec_filter.c) when a loaded pcre_regex() substitution filter matches packets. A network-adjacent attacker can send matching packets to corrupt memory and potentially execute code as root.

first public Nov 6, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

Anyone running Ettercap 0.8.4.1 or earlier (built with PCRE2) with a loaded pcre_regex() substitution filter and not in unoffensive mode. An attacker on the same network segment who sends a packet matching the pattern can corrupt heap memory in a process that usually runs as root. Skip it if you do not use filters, only use pcre_regex() without replacement, use unoffensive mode, or have a pcre1 build.

ettercap<= 0.8.4.1

Not affected if no-ettercap-installed, no-filters, no-pcre-regex-filter, not-on-attacker-network, pcre1-build, unoffensive-mode

Who cares ettercap, linux, network-security, pcre2, root

02 · How to check

Run ettercap --version; 0.8.4.1 and earlier are affected, and no release has the fix yet.
Exposed only if Ettercap is built with PCRE2 (the default on current distributions), is not run in unoffensive mode, and loads a compiled filter (.ef) whose source uses pcre_regex() with a replacement string. Check your filter sources (.filter files) for pcre_regex( with two arguments.
Builds using the old pcre1 path are not affected.

03 · The fix

✓ Verified Nov 10

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

3 events · Nov 6, 2026 → Nov 10, 2026

Nov 6, 202602:58 UTCgithub.com Vendor advisory: github.com
Nov 10, 202600:28 UTCNVD CVE-2026-125400
Nov 10, 202600:30 UTCInfraStack Analyst Read GHSA-f3j5-rhhr-85j5 and merge commit 1d8badb (PR #1330). Advisory lists patched versions: None; fix merged to master 2026-11-06, no release yet. Requires pcre_regex() substitution filter, PCRE2 build, not unoffensive mode. No exploitation or PoC reported.

What the sources say, verbatim

304 characters

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.

Sources and references

NVD: CVE-2026-125400Nov 10, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Ettercap threat the day it hits your stack.

Start free

Post Share

HIGH8.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

ETTERCAP · CVE-2026-125400 · Package

Ettercap: use-after-free in filter code lets network attackers run code as root

NO FIX YET · SEE WHAT TO DO

first public Nov 6, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

ettercap<= 0.8.4.1

Not affected if no-ettercap-installed, no-filters, no-pcre-regex-filter, not-on-attacker-network, pcre1-build, unoffensive-mode

Who cares ettercap, linux, network-security, pcre2, root

02 · How to check

Run ettercap --version; 0.8.4.1 and earlier are affected, and no release has the fix yet.
Exposed only if Ettercap is built with PCRE2 (the default on current distributions), is not run in unoffensive mode, and loads a compiled filter (.ef) whose source uses pcre_regex() with a replacement string. Check your filter sources (.filter files) for pcre_regex( with two arguments.
Builds using the old pcre1 path are not affected.

03 · The fix

✓ Verified Nov 10

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

3 events · Nov 6, 2026 → Nov 10, 2026

Nov 6, 202602:58 UTCgithub.com Vendor advisory: github.com
Nov 10, 202600:28 UTCNVD CVE-2026-125400
Nov 10, 202600:30 UTCInfraStack Analyst Read GHSA-f3j5-rhhr-85j5 and merge commit 1d8badb (PR #1330). Advisory lists patched versions: None; fix merged to master 2026-11-06, no release yet. Requires pcre_regex() substitution filter, PCRE2 build, not unoffensive mode. No exploitation or PoC reported.

What the sources say, verbatim

304 characters

Sources and references

NVD: CVE-2026-125400Nov 10, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Ettercap threat the day it hits your stack.

Start free

Ettercap: use-after-free in filter code lets network attackers run code as root

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ettercap threat the day it hits your stack.

Ettercap: use-after-free in filter code lets network attackers run code as root

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ettercap threat the day it hits your stack.