CVE-2026-125406 · Other
NO FIX YET · SEE WHAT TO DO
Ettercap's telnet dissector decrements its output pointer on backspace without a lower bound check, so a crafted telnet stream with more backspaces than preceding characters writes below a stack buffer. An attacker can corrupt the stack of the Ettercap process, which normally runs as root.
first public Nov 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Ettercap to sniff or intercept network traffic are exposed, because the telnet dissector parses traffic Ettercap sees on the wire. Systems that do not have Ettercap installed, or do not parse telnet traffic with it, can skip it. Whether a default configuration enables the telnet dissector is unknown.
Not affected if ettercap-not-installed
Who cares ettercap, linux, network-sniffing
0.8.4.1 or earlier (through 0.8.4.1)0.8.4.1 are not stated as fixed in the sources; check the linked patch and vendor advisory for the fixed versionEttercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_telnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.