{"id":"CVE-2026-125401","kind":"vulnerability","aliases":["CVE-2026-125401"],"related":[],"title":"Ettercap: heap overflow in Gadu-Gadu parser lets network attackers corrupt memory","description":"Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.","summary":"Ettercap through 0.8.4.1 has a heap buffer overflow in the Gadu-Gadu dissector, where a crafted version field writes up to 44 bytes into a 30-byte allocation. A remote attacker who sends that traffic through a network Ettercap is monitoring can corrupt heap memory in the Ettercap process, which normally runs as root.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ettercap","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ettercap","linux","network-monitoring","other","security-tools"],"not_affected_if":["ettercap-newer-than-0.8.4.1","no-ettercap-install","not-monitoring-network"],"how_to_check":"- Check whether Ettercap is installed and run `ettercap --version` (or check the package manager) to see whether it is `0.8.4.1` or earlier.\n- Check whether Ettercap is used to monitor or dissect traffic on a network where TCP port 8074 (Gadu-Gadu) can be reached.","fix":"- Patch linked in the sources (github.com); the fixed version is not stated.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:30:02+00:00","updated_at":"2026-11-10T00:30:02+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T00:30:02Z","model":"claude-haiku-5-5","output":{"fix":"- Patch linked in the sources (github.com); the fixed version is not stated.","reach":"network","title":"Ettercap: heap overflow in Gadu-Gadu parser lets network attackers corrupt memory","impact":"high","summary":"Ettercap through 0.8.4.1 has a heap buffer overflow in the Gadu-Gadu dissector, where a crafted version field writes up to 44 bytes into a 30-byte allocation. A remote attacker who sends that traffic through a network Ettercap is monitoring can corrupt heap memory in the Ettercap process, which normally runs as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ettercap","network-monitoring","linux","security-tools"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts Ettercap heap memory while it runs as root.","analyst_note":"","how_to_check":"- Check whether Ettercap is installed and run `ettercap --version` (or check the package manager) to see whether it is `0.8.4.1` or earlier.\n- Check whether Ettercap is used to monitor or dissect traffic on a network where TCP port 8074 (Gadu-Gadu) can be reached.","plain_action":"","product_name":"Ettercap","needs_analyst":false,"not_affected_if":["no-ettercap-install","not-monitoring-network","ettercap-newer-than-0.8.4.1"],"who_is_affected":"Ettercap through 0.8.4.1 is affected when it dissects traffic on a monitored network, since the flawed Gadu-Gadu parser runs on traffic that passes through it. Systems that do not run Ettercap, or that do not monitor networks where TCP port 8074 traffic can be seen, are not exposed to this path.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001373,"input_tokens":4666,"output_tokens":1813,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125401':16A,19A '-2026':15A,18A '0.8.4.1':32B,87C '30':56B,108C '44':52B,104C '8074':122C 'alloc':58B,110C 'attack':11A,61B,112C 'buffer':36B,91C 'byte':53B,57B,105C,109C 'contain':88C 'corrupt':12A,73B,133C 'craft':46B,125C 'cve':14A,17A 'dissector':43B 'ettercap':1A,20A,21B,30B,69B,78B,85C,138C 'field':48B,127C 'gadu':6A,7A,41B,42B,116C,117C 'gadu-gadu':5A,40B,115C 'get':96C 'gg':95C 'heap':2A,35B,74B,90C,134C 'let':9A 'linux':22B 'memori':13A,75B,135C 'monitor':25B,71B,130C 'network':10A,24B,68B,131C 'network-monitor':23B 'normal':81B,141C 'overflow':3A,37B,92C 'parser':8A 'port':121C 'process':79B,139C 'remot':60B,111C 'root':84B,144C 'run':82B,142C 'secur':28B 'security-tool':27B 'send':63B,114C 'src/dissectors/ec_gg.c':99C 'tcp':120C 'tool':29B 'traffic':65B,118C 'version':47B,97C,126C 'vulner':93C 'write':49B,101C","nicknames":[],"mitigations":[],"who_affected":"Ettercap through 0.8.4.1 is affected when it dissects traffic on a monitored network, since the flawed Gadu-Gadu parser runs on traffic that passes through it. Systems that do not run Ettercap, or that do not monitor networks where TCP port 8074 traffic can be seen, are not exposed to this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","linux","networkmonitoring","other","securitytools","vendor"],"campaign_type":null,"search_a":"'-125401':16A,19A '-2026':15A,18A 'attack':11A 'corrupt':12A 'cve':14A,17A 'ettercap':1A,20A 'gadu':6A,7A 'gadu-gadu':5A 'heap':2A 'let':9A 'memori':13A 'network':10A 'overflow':3A 'parser':8A","search_b":"'0.8.4.1':32B '30':56B '44':52B 'alloc':58B 'attack':61B 'buffer':36B 'byte':53B,57B 'corrupt':73B 'craft':46B 'dissector':43B 'ettercap':21B,30B,69B,78B 'field':48B 'gadu':41B,42B 'gadu-gadu':40B 'heap':35B,74B 'linux':22B 'memori':75B 'monitor':25B,71B 'network':24B,68B 'network-monitor':23B 'normal':81B 'overflow':37B 'process':79B 'remot':60B 'root':84B 'run':82B 'secur':28B 'security-tool':27B 'send':63B 'tool':29B 'traffic':65B 'version':47B 'write':49B","search_c":"'0.8.4.1':87C '30':108C '44':104C '8074':122C 'alloc':110C 'attack':112C 'buffer':91C 'byte':105C,109C 'contain':88C 'corrupt':133C 'craft':125C 'ettercap':85C,138C 'field':127C 'gadu':116C,117C 'gadu-gadu':115C 'get':96C 'gg':95C 'heap':90C,134C 'memori':135C 'monitor':130C 'network':131C 'normal':141C 'overflow':92C 'port':121C 'process':139C 'remot':111C 'root':144C 'run':142C 'send':114C 'src/dissectors/ec_gg.c':99C 'tcp':120C 'traffic':118C 'version':97C,126C 'vulner':93C 'write':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125401","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111606,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-vrjv-f8gv-2h35","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111607,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-buffer-overflow-via-gadu-gadu-dissector","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}