Description
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.
Published: 2026-11-09
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw (CWE‑416) resides in func_pcre() of src/ec_filter.c. When a packet matches a loaded PCRE2 substitution filter, Ettercap frees the match data but subsequently reads the freed ovector, allowing crafted packets to corrupt memory and potentially execute arbitrary code with root privileges.

Affected Systems

The Ettercap network monitoring tool, versions up to and including 0.8.4.1, is vulnerable. Users running 0.8.4.1 or an earlier release should verify the exact version and plan an upgrade.

Risk and Exploitability

The CVSS base score of 8.7 classifies this as a high‑severity item; the EPSS score is not available, indicating limited exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers adjacent on the network can send crafted packets that trigger the use‑after‑free, and if memory corruption is achieved, arbitrary code execution as root becomes possible.

Generated by OpenCVE AI on November 10, 2026 at 01:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Ettercap to version 0.8.4.2 or later, where the use‑after‑free bug is fixed.
  • If an upgrade cannot be performed immediately, remove or disable any PCRE2 substitution filters and restrict Ettercap to minimal safe functionality.
  • Configure firewall or network segmentation to ensure Ettercap processes traffic only on trusted internal interfaces, blocking external or untrusted packet sources.

Generated by OpenCVE AI on November 10, 2026 at 01:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Ettercap
Ettercap ettercap
Vendors & Products Ettercap
Ettercap ettercap

Mon, 09 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Description Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.
Title Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
First Time appeared Ettercap-project
Ettercap-project ettercap
Weaknesses CWE-416
CPEs cpe:2.3:a:ettercap-project:ettercap:*:*:*:*:*:*:*:*
Vendors & Products Ettercap-project
Ettercap-project ettercap
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ettercap Ettercap
Ettercap-project Ettercap
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-09T23:28:02.839Z

Reserved: 2026-11-09T22:03:15.134Z

Link: CVE-2026-125400

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-10T00:17:14.387

Modified: 2026-11-10T00:17:14.387

Link: CVE-2026-125400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-10T01:30:17Z

Weaknesses