ETTERCAP · CVE-2026-125401 · Other
NO FIX YET · SEE WHAT TO DO
Ettercap through 0.8.4.1 has a heap buffer overflow in the Gadu-Gadu dissector, where a crafted version field writes up to 44 bytes into a 30-byte allocation. A remote attacker who sends that traffic through a network Ettercap is monitoring can corrupt heap memory in the Ettercap process, which normally runs as root.
first public Nov 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Ettercap through 0.8.4.1 is affected when it dissects traffic on a monitored network, since the flawed Gadu-Gadu parser runs on traffic that passes through it. Systems that do not run Ettercap, or that do not monitor networks where TCP port 8074 traffic can be seen, are not exposed to this path.
Not affected if ettercap-newer-than-0.8.4.1, no-ettercap-install, not-monitoring-network
Who cares ettercap, linux, network-monitoring, security-tools
ettercap --version (or check the package manager) to see whether it is 0.8.4.1 or earlier.Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.