Ettercap through version 0.8.4.1 exhibits an integer underflow in the ccmp_decrypt function in src/ec_encryption_ccmp.c. This flaw subtracts the 8‑byte CCMP trailer from a packet length without first validating that the packet is long enough, allowing an attacker to send a short WPA CCMP frame that overflows a stack buffer in the Ettercap process. Because the process typically runs with root privileges, successful exploitation can lead to arbitrary code execution on the host.

The vulnerable product is the Ettercap utility from the Ettercap Project, version 0.8.4.1. Any installation that uses this release, whether packaged or compiled from source, is affected.

The CVSS score of 7.7 indicates a high severity vulnerability. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of those metrics does not reduce the risk. Attackers must be on the target WPA network and possess the correct key loaded into Ettercap to transmit a malformed CCMP frame. Since the process runs with elevated privileges, the stack overflow can result in full system compromise. The attack vector is network‑based and requires controlled access to the WPA‑protected link.