---
id: "CVE-2026-125401"
page: "https://infrastack.ai/live/CVE-2026-125401"
kind: "vulnerability"
aliases: ["CVE-2026-125401"]
title: "Ettercap: heap overflow in Gadu-Gadu parser lets network attackers corrupt memory"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Ettercap", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ettercap", "linux", "network-monitoring", "other", "security-tools"]
not_affected_if: ["ettercap-newer-than-0.8.4.1", "no-ettercap-install", "not-monitoring-network"]
published_at: "2026-11-10T00:17:14+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:30:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125401", "first_seen_at": "2026-11-10T00:28:44+00:00"}]
exploit_sources: []
---

# Ettercap: heap overflow in Gadu-Gadu parser lets network attackers corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-125401 (this .md is for agents)

Ettercap through 0.8.4.1 has a heap buffer overflow in the Gadu-Gadu dissector, where a crafted version field writes up to 44 bytes into a 30-byte allocation. A remote attacker who sends that traffic through a network Ettercap is monitoring can corrupt heap memory in the Ettercap process, which normally runs as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ettercap affected range not listed fixed no fixed version listed

## How to check

- Check whether Ettercap is installed and run `ettercap --version` (or check the package manager) to see whether it is `0.8.4.1` or earlier.
- Check whether Ettercap is used to monitor or dissect traffic on a network where TCP port 8074 (Gadu-Gadu) can be reached.

## Fix

- Patch linked in the sources (github.com); the fixed version is not stated.

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125401

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Ettercap/ettercap/security/advisories/GHSA-vrjv-f8gv-2h35
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-buffer-overflow-via-gadu-gadu-dissector
- [fix] Patch: github.com https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98

## From the sources

Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_