The vulnerability is a heap buffer overflow in the gg_get_version() function of Ettercap's Gadu‑Gadu dissector, where up to 44 bytes are written into a 30‑byte allocation. This can overwrite adjacent memory and allow a malicious actor to corrupt the Ettercap process, which normally runs with root privileges, potentially leading to arbitrary code execution for an attacker on the network.

Ettercap version 0.8.4.1 and any earlier builds that include the unpatched gg_get_version() function are affected. The issue exists in the Gadu‑Gadu traffic dissector of the Ettercap packet‑inspection tool.

The CVSS score of 7.2 indicates a high impact with the potential for confidentiality, integrity, and availability compromise. The EPSS score is not available at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can craft Gadu‑Gadu traffic on TCP port 8074 and send it through a network that Ettercap is monitoring, exploiting the heap overflow during packet processing. Exploitation requires that Ettercap is active on the network, but no local privilege is required beyond normal operation as root.