{"id":"CVE-2026-125405","kind":"vulnerability","aliases":["CVE-2026-125405"],"related":[],"title":"Ettercap: crafted NTLM HTTP header reads past buffer, leaking memory","description":"Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.","summary":"Ettercap through 0.8.4.1 fails to validate NTLM message offsets in Parse_NTLM_Auth(), so reading an HTTP Authorization header can read beyond the buffer. An attacker who sends a crafted header that Ettercap observes can disclose process memory or crash it.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.4.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ettercap","network-security","other","out-of-bounds-read","pentesting"],"not_affected_if":["ettercap-not-installed"],"how_to_check":"- Run `ettercap --version`; 0.8.4.1 and earlier are affected, and no released version contains the fix yet.\n- If you build from git, check that your tree includes commit 1d8badb713579419a29a494bb463a1af59707e98 (`git merge-base --is-ancestor 1d8badb HEAD`).\n- Find hosts where Ettercap sniffs HTTP on a shared network (analysis workstations, pentest boxes). Packaged copies from distros may lack the fix too.","fix":"No patched release yet (advisory lists patched versions: none). The fix is merged to master in commit 1d8badb (PR #1330, 2026-11-06): it validates the decoded NTLM length and every offset+len before reading. Build from master at or after that commit until a release ships.","status":"open","published_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","triaged_at":"2026-11-10T00:29:54+00:00","updated_at":"2026-11-10T00:31:13+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T00:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: crafted NTLM HTTP header reads past buffer, leaking memory","impact":"medium","summary":"Ettercap through 0.8.4.1 fails to validate NTLM message offsets in Parse_NTLM_Auth(), so reading an HTTP Authorization header can read beyond the buffer. An attacker who sends a crafted header that Ettercap observes can disclose process memory or crash it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ettercap","network-security","pentesting"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process memory disclosed or Ettercap crashes while parsing traffic","analyst_note":"Confirm the fixed version and the patch commit from the linked GitHub patch and vendor advisory; the sources here do not state one.","how_to_check":"- Check the installed version with `ettercap --version` and compare it against the fixed release named in the vendor advisory.\n- Look for Ettercap on sensing hosts or analysis workstations that sniff HTTP traffic on a shared network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ettercap-not-installed"],"who_is_affected":"Only machines running Ettercap while it inspects HTTP traffic are exposed, since the flaw is triggered by an HTTP Authorization header that Ettercap parses. Teams that do not run Ettercap for network sniffing or MITM work can skip it. The sources do not state a fixed version.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4639,"output_tokens":577,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch commit from the linked GitHub patch and vendor advisory; the sources here do not state one.","search":"'-125405':13A,16A '-2026':12A,15A '0.8.4.1':31B,71C 'attack':54B,92C 'auth':41B,83C 'author':46B,98C 'beyond':50B,105C 'bound':26B,77C 'buffer':8A,52B,107C 'contain':72C 'craft':2A,58B,96C 'crash':68B,111C 'cve':11A,14A 'disclos':64B,108C 'due':86C 'ettercap':1A,17A,18B,29B,61B,69C,102C 'fail':32B 'header':5A,47B,59B,99C 'http':4A,45B,97C 'leak':9A 'memori':10A,66B,109C 'messag':36B,90C 'network':20B 'network-secur':19B 'ntlm':3A,35B,40B,82C,89C 'observ':62B,100C 'offset':37B,91C 'out-of-bound':74C 'out-of-bounds-read':23B 'pars':39B,81C 'past':7A 'pentest':28B 'process':65B,113C 'read':6A,27B,43B,49B,78C,104C 'secur':21B 'send':56B,94C 'src/dissectors/ec_http.c':85C 'unvalid':88C 'valid':34B 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Ettercap (0.8.4.1 and earlier) with the HTTP dissector active are exposed: a peer on the same network segment can send an HTTP Authorization or Proxy-Authorization NTLM Type 3 header that makes Ettercap read heap memory beyond its buffer. The leaked bytes are printed and logged on the operator's console, and the process can crash. Teams that do not run Ettercap for sniffing or MITM work can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T00:31:13Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2357},"how_to_check":{"at":"2026-11-10T00:31:13Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2357},"who_affected":{"at":"2026-11-10T00:31:13Z","by":"analyst","doc":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","run_id":2357}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","networksecurity","other","outofboundsread","pentesting"],"campaign_type":null,"search_a":"'-125405':13A,16A '-2026':12A,15A 'buffer':8A 'craft':2A 'cve':11A,14A 'ettercap':1A,17A 'header':5A 'http':4A 'leak':9A 'memori':10A 'ntlm':3A 'past':7A 'read':6A","search_b":"'0.8.4.1':31B 'attack':54B 'auth':41B 'author':46B 'beyond':50B 'bound':26B 'buffer':52B 'craft':58B 'crash':68B 'disclos':64B 'ettercap':18B,29B,61B 'fail':32B 'header':47B,59B 'http':45B 'memori':66B 'messag':36B 'network':20B 'network-secur':19B 'ntlm':35B,40B 'observ':62B 'offset':37B 'out-of-bounds-read':23B 'pars':39B 'pentest':28B 'process':65B 'read':27B,43B,49B 'secur':21B 'send':56B 'valid':34B","search_c":"'0.8.4.1':71C 'attack':92C 'auth':83C 'author':98C 'beyond':105C 'bound':77C 'buffer':107C 'contain':72C 'craft':96C 'crash':111C 'disclos':108C 'due':86C 'ettercap':69C,102C 'header':99C 'http':97C 'memori':109C 'messag':90C 'ntlm':82C,89C 'observ':100C 'offset':91C 'out-of-bound':74C 'pars':81C 'process':113C 'read':78C,104C 'send':94C 'src/dissectors/ec_http.c':85C 'unvalid':88C 'vulner':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-06T02:58:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125405","severity":null,"published_at":"2026-11-10T00:17:15+00:00","modified_at":"2026-11-10T00:17:15+00:00","first_seen_at":"2026-11-10T00:28:45+00:00","fetched_at":"2026-11-10T00:28:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125405:2357","url":null,"severity":null,"published_at":"2026-11-10T00:31:13+00:00","modified_at":"2026-11-10T00:31:13+00:00","first_seen_at":"2026-11-10T00:31:13+00:00","fetched_at":"2026-11-10T00:31:13+00:00","note":"Read GHSA-jw9q-j2rm-94j2 (affected <=0.8.4.1, patched: none, heap OOB read in Parse_NTLM_Auth/GetUnicodeString, adjacent-network) and merge commit 1d8badb (PR #1330, master, 2026-11-06). No release contains the fix. No exploitation or PoC seen; did not search social."}],"documents":[{"id":111602,"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111618,"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-jw9q-j2rm-94j2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T02:58:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111619,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-http-ntlm-authentication-parsing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}