Ettercap versions up to 0.8.4.1 contain a heap out‑of‑bounds read in the sslw_get_clienthello_sni() routine. The flaw arises because the code trusts an unchecked 16‑bit TLS Server Name Indication (SNI) length field, allowing an attacker to construct a TLS ClientHello that causes Ettercap to read beyond the bounds of its buffer. This can expose up to 64 KB of arbitrary heap data upstream or trigger a crash, resulting in information disclosure or denial of service. The weakness is classified as CWE‑125, reflecting an improper bound check on an array.

Ettercap, an open‑source network monitoring and packet‑sniffing tool, is affected. The flaw exists in all releases up to and including 0.8.4.1. No operating‑system or platform dependency is mentioned, meaning any deployment that runs a vulnerable version of Ettercap and performs TLS interception is potentially impacted.

The CVSS score of 7.2 indicates a high severity level. The EPSS score is not available, so the current risk of exploitation cannot be quantified precisely, but the vulnerability is exploitable by any host on the same network segment that can send crafted TLS ClientHello messages to the Ettercap instance. No authentication or privilege escalation is required, so a network‑adjacent attacker could trigger the read or crash. The vulnerability is not listed in the CISA KEV catalog.