{"id":"CVE-2026-125400","kind":"vulnerability","aliases":["CVE-2026-125400"],"related":[],"title":"Ettercap: use-after-free in filter code lets network attackers run code as root","description":"Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.","summary":"Ettercap through 0.8.4.1 reads freed PCRE2 match data in its filter code (func_pcre in src/ec_filter.c) when a loaded pcre_regex() substitution filter matches packets. A network-adjacent attacker can send matching packets to corrupt memory and potentially execute code as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.4.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ettercap","linux","network-security","package","pcre2","root"],"not_affected_if":["no-ettercap-installed","no-filters","no-pcre-regex-filter","not-on-attacker-network","pcre1-build","unoffensive-mode"],"how_to_check":"- Run `ettercap --version`; 0.8.4.1 and earlier are affected, and no release has the fix yet.\n- Exposed only if Ettercap is built with PCRE2 (the default on current distributions), is not run in unoffensive mode, and loads a compiled filter (.ef) whose source uses pcre_regex() with a replacement string. Check your filter sources (.filter files) for pcre_regex( with two arguments.\n- Builds using the old pcre1 path are not affected.","fix":"No released version yet (advisory: patched versions none). Fix is merged to master in commit 1d8badb713579419a29a494bb463a1af59707e98 (PR #1330); build from master after that commit, or stop loading pcre_regex() substitution filters until a release.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:46+00:00","updated_at":"2026-11-10T00:30:06+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T00:29:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: use-after-free in filter code lets network attackers run code as root","impact":"high","summary":"Ettercap through 0.8.4.1 reads freed PCRE2 match data in its filter code (func_pcre in src/ec_filter.c) when a loaded pcre_regex() substitution filter matches packets. A network-adjacent attacker can send matching packets to corrupt memory and potentially execute code as root.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ettercap","network-security","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code as root on the Ettercap host","analyst_note":"Confirm the fixed version and any patch from the linked GitHub patch and vendor advisory; the sources given do not state a fixed version.","how_to_check":"- Check the installed version with `ettercap --version`; versions through `0.8.4.1` are in the affected range.\n- Look for filter files loaded with pcre_regex() in your Ettercap configuration; the exposure requires a loaded pcre_regex() substitution filter.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ettercap-installed","no-pcre-regex-filter","not-on-attacker-network"],"who_is_affected":"Ettercap is a network sniffing and man-in-the-middle tool, usually run by security testers or on monitoring hosts. Exposure requires Ettercap to be running with a pcre_regex() substitution filter loaded and an attacker on the same network segment sending matching packets. Systems that do not run Ettercap, or run it without such a filter, can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4631,"output_tokens":622,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any patch from the linked GitHub patch and vendor advisory; the sources given do not state a fixed version.","search":"'-125400':18A,21A '-2026':17A,20A '0.8.4.1':33B,76C 'adjac':59B,100C 'attack':11A,60B,101C 'code':8A,13A,42B,71B,118C 'contain':77C 'corrupt':66B,113C 'cve':16A,19A 'data':38B,97C 'ettercap':1A,22A,23B,31B,74C 'execut':70B,117C 'filter':7A,41B,53B,111C 'free':5A,82C,95C 'freed':35B 'func':43B,85C 'let':9A 'linux':24B 'load':49B,107C 'match':37B,54B,63B,96C,105C 'memori':67B,114C 'network':10A,26B,58B,99C 'network-adjac':57B,98C 'network-secur':25B 'ovector':93C 'packag':28B 'packet':55B,64B,104C 'pcre':44B,50B,86C,108C 'pcre2':29B,36B,92C 'potenti':69B,116C 'read':34B,90C 'regex':51B,109C 'root':15A,30B,73B,120C 'run':12A 'secur':27B 'send':62B,103C 'src/ec_filter.c':46B,88C 'substitut':52B,110C 'use':3A,80C 'use-after-fre':2A,79C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Ettercap 0.8.4.1 or earlier (built with PCRE2) with a loaded pcre_regex() substitution filter and not in unoffensive mode. An attacker on the same network segment who sends a packet matching the pattern can corrupt heap memory in a process that usually runs as root. Skip it if you do not use filters, only use pcre_regex() without replacement, use unoffensive mode, or have a pcre1 build.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:30:06Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2355},"who_affected":{"at":"2026-11-10T00:30:06Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2355}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","linux","networksecurity","package","pcre2","root"],"campaign_type":null,"search_a":"'-125400':18A,21A '-2026':17A,20A 'attack':11A 'code':8A,13A 'cve':16A,19A 'ettercap':1A,22A 'filter':7A 'free':5A 'let':9A 'network':10A 'root':15A 'run':12A 'use':3A 'use-after-fre':2A","search_b":"'0.8.4.1':33B 'adjac':59B 'attack':60B 'code':42B,71B 'corrupt':66B 'data':38B 'ettercap':23B,31B 'execut':70B 'filter':41B,53B 'freed':35B 'func':43B 'linux':24B 'load':49B 'match':37B,54B,63B 'memori':67B 'network':26B,58B 'network-adjac':57B 'network-secur':25B 'packag':28B 'packet':55B,64B 'pcre':44B,50B 'pcre2':29B,36B 'potenti':69B 'read':34B 'regex':51B 'root':30B,73B 'secur':27B 'send':62B 'src/ec_filter.c':46B 'substitut':52B","search_c":"'0.8.4.1':76C 'adjac':100C 'attack':101C 'code':118C 'contain':77C 'corrupt':113C 'data':97C 'ettercap':74C 'execut':117C 'filter':111C 'free':82C,95C 'func':85C 'load':107C 'match':96C,105C 'memori':114C 'network':99C 'network-adjac':98C 'ovector':93C 'packet':104C 'pcre':86C,108C 'pcre2':92C 'potenti':116C 'read':90C 'regex':109C 'root':120C 'send':103C 'src/ec_filter.c':88C 'substitut':110C 'use':80C 'use-after-fre':79C 'vulner':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125400","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125400:2355","url":null,"severity":null,"published_at":"2026-11-10T00:30:06+00:00","modified_at":"2026-11-10T00:30:06+00:00","first_seen_at":"2026-11-10T00:30:06+00:00","fetched_at":"2026-11-10T00:30:06+00:00","note":"Read GHSA-f3j5-rhhr-85j5 and merge commit 1d8badb (PR #1330). Advisory lists patched versions: None; fix merged to master 2026-11-06, no release yet. Requires pcre_regex() substitution filter, PCRE2 build, not unoffensive mode. No exploitation or PoC reported."}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111603,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-f3j5-rhhr-85j5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111604,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-use-after-free-via-pcre2-filter-substitution","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}