{"id":"CVE-2026-129432","kind":"vulnerability","aliases":["CVE-2026-129432"],"related":[],"title":"Ettercap: heap out-of-bounds read in MOUNT dissector leaks memory","description":"Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adjacent attackers can send a crafted MOUNT MNT call to read up to 100 bytes past the heap buffer, leaking memory to the console and logs.","summary":"Ettercap through 0.8.5.1 has a heap out-of-bounds read in its MOUNT RPC dissector, where credential and directory lengths are checked separately instead of against the packet end. A network-adjacent attacker sending a crafted MOUNT MNT call can leak up to 100 bytes of heap memory to the console and logs.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ettercap","fixed":[],"affected":"<= 0.8.5.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ettercap","linux","network-security","other","self-hosted"],"not_affected_if":["ettercap-not-installed","no-live-capture","version-above-0.8.5.1"],"how_to_check":"- Run ettercap --version; 0.8.5.1 and earlier are affected, and no fixed release is known yet.\n- Check where Ettercap runs (sniffing or MITM test hosts) and whether it sees NFS MOUNT (RPC mountd) traffic from untrusted hosts on the segment.\n- Also check distro packages: they track the same upstream code.","fix":"No released fix found: latest release 0.8.5.1 is affected. Fix PR #1341 (bound every read in dissector_mountd() against the packet end) is closed and not confirmed merged; watch the Ettercap repo for a release after 0.8.5.1.","status":"open","published_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","triaged_at":"2026-11-14T13:29:01+00:00","updated_at":"2026-11-14T13:30:36+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-14T13:29:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ettercap: heap out-of-bounds read in MOUNT dissector leaks memory","impact":"low","summary":"Ettercap through 0.8.5.1 has a heap out-of-bounds read in its MOUNT RPC dissector, where credential and directory lengths are checked separately instead of against the packet end. A network-adjacent attacker sending a crafted MOUNT MNT call can leak up to 100 bytes of heap memory to the console and logs.","audience":"developers","category":"other","nicknames":[],"who_cares":["ettercap","network-security","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Up to 100 bytes of heap memory leak into console and logs","analyst_note":"Confirm whether a fixed Ettercap release exists and whether the MOUNT dissector is enabled by default; check the vulncheck advisory for remediation details.","how_to_check":"- Check the installed Ettercap version with `ettercap --version` and compare it against the affected range through 0.8.5.1.\n- Look for Ettercap on machines used for network sniffing or man-in-the-middle testing.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ettercap-not-installed","version-above-0.8.5.1"],"who_is_affected":"Teams that run Ettercap on a network they share with untrusted hosts, typically for sniffing or security testing. Systems that do not have Ettercap installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4618,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed Ettercap release exists and whether the MOUNT dissector is enabled by default; check the vulncheck advisory for remediation details.","search":"'-129432':15A,18A '-2026':14A,17A '0.8.5.1':31B,86C '100':74B,130C 'adjac':62B,117C 'attack':63B,118C 'bound':6A,38B,93C 'buffer':135C 'byte':75B,131C 'call':69B,125C 'check':51B 'consol':81B,140C 'contain':87C 'craft':66B,122C 'credenti':46B,104C 'cve':13A,16A 'directori':48B,106C 'dissector':10A,44B,97C 'end':58B,114C 'ettercap':1A,19A,20B,29B,84C 'heap':2A,34B,77B,89C,134C 'host':28B 'independ':108C 'instead':53B 'leak':11A,71B,136C 'length':49B,107C 'linux':21B 'log':83B,142C 'memori':12A,78B,137C 'mnt':68B,124C 'mount':9A,42B,67B,123C 'mountd':98C 'network':23B,61B,116C 'network-adjac':60B,115C 'network-secur':22B 'out-of-bound':3A,35B,90C 'packet':57B,113C 'past':132C 'rather':109C 'read':7A,39B,94C,127C 'rpc':43B,103C 'secur':24B 'self':27B 'self-host':26B 'send':64B,120C 'separ':52B 'src/dissectors/ec_mountd.c':100C 'valid':102C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Ettercap (through 0.8.5.1) on a network segment shared with untrusted hosts, mostly for sniffing or security testing. A crafted NFS MOUNT call makes the dissector read up to 100 bytes past the packet buffer and print it to the console and logs. This is an information leak with adjacent-network access needed, so hosts without Ettercap, or where it is not run on live traffic, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ettercap"],"ptokens":["ettercap"],"labels":["ettercap","high","linux","networksecurity","other","selfhosted"],"campaign_type":null,"search_a":"'-129432':15A,18A '-2026':14A,17A 'bound':6A 'cve':13A,16A 'dissector':10A 'ettercap':1A,19A 'heap':2A 'leak':11A 'memori':12A 'mount':9A 'out-of-bound':3A 'read':7A","search_b":"'0.8.5.1':31B '100':74B 'adjac':62B 'attack':63B 'bound':38B 'byte':75B 'call':69B 'check':51B 'consol':81B 'craft':66B 'credenti':46B 'directori':48B 'dissector':44B 'end':58B 'ettercap':20B,29B 'heap':34B,77B 'host':28B 'instead':53B 'leak':71B 'length':49B 'linux':21B 'log':83B 'memori':78B 'mnt':68B 'mount':42B,67B 'network':23B,61B 'network-adjac':60B 'network-secur':22B 'out-of-bound':35B 'packet':57B 'read':39B 'rpc':43B 'secur':24B 'self':27B 'self-host':26B 'send':64B 'separ':52B","search_c":"'0.8.5.1':86C '100':130C 'adjac':117C 'attack':118C 'bound':93C 'buffer':135C 'byte':131C 'call':125C 'consol':140C 'contain':87C 'craft':122C 'credenti':104C 'directori':106C 'dissector':97C 'end':114C 'ettercap':84C 'heap':89C,134C 'independ':108C 'leak':136C 'length':107C 'log':142C 'memori':137C 'mnt':124C 'mount':123C 'mountd':98C 'network':116C 'network-adjac':115C 'out-of-bound':90C 'packet':113C 'past':132C 'rather':109C 'read':94C,127C 'rpc':103C 'send':120C 'src/dissectors/ec_mountd.c':100C 'valid':102C 'vulner':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129432","severity":null,"published_at":"2026-11-14T13:17:22+00:00","modified_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","fetched_at":"2026-11-14T13:28:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129432:3983","url":"https://github.com/Ettercap/ettercap/pull/1341","severity":null,"published_at":"2026-11-14T13:30:36+00:00","modified_at":"2026-11-14T13:30:36+00:00","first_seen_at":"2026-11-14T13:30:36+00:00","fetched_at":"2026-11-14T13:30:36+00:00","note":"VulnCheck advisory read (affects <=0.8.5.1, credit stilwel/Emilio Escobar). Fix PR #1341 (bounds every mountd read against packet end; ASAN-verified in the PR) shows state closed, not clearly merged to master, and the latest release 0.8.5.1 (10 Nov) predates it. So no released fix found. Not checked: whether the dissector is on by default; no vendor advisory page yet. PoC: none public. No X search done (low-profile CVE).","cites":["https://github.com/Ettercap/ettercap/pull/1341","https://github.com/Ettercap/ettercap/releases"]}],"documents":[{"id":155849,"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.5.1-heap-out-of-bounds-read-in-nfs-mountd-dissector","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":155857,"url":"https://github.com/Ettercap/ettercap/pull/1341","title":"PR #1341: Bound every read in the mountd dissector against the packet (closed)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":155858,"url":"https://github.com/Ettercap/ettercap/releases","title":"Ettercap releases (latest 0.8.5.1)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}