Ettercap, up to version 0.8.3, contains a heap-based buffer overflow in the FUNC_DECODER function of the GG dissector module (ec_gg.c). Malicious manipulation of the gg argument can cause a heap overflow, potentially allowing an attacker to execute arbitrary code on systems running the vulnerable dissector. The flaw is a classic out-of-bounds write (CWE-119/CWE-122) and is considered exploitable only with remote network traffic that engages the dissector, making the attack vector remote but requiring the attacker to craft specific probe packets.

All installations of Ettercap 0.8.3 and earlier are affected, regardless of operating system. The upstream repository maintains version 0.8.4 as the patched release and suggests applying that update to eliminate the vulnerability.

The CVSS score of 6.3 indicates a moderate to high impact severity. The EPSS score is currently unavailable, but the vulnerability has been publicly disclosed and is considered difficult to exploit, implying a low to moderate exploitation probability. The flaw is not listed in the CISA KEV catalog, and no widespread exploitation is reported yet. An attacker must remotely access the target through network traffic that triggers the GG dissector and craft malformed packets to exploit the heap overflow. The complexity of such an attack is high, and the exploitability is described as difficult, but the potential outcome of arbitrary code execution or denial of service warrants early remediation.