CVE-2026-125400: Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in funcpcre() in src/ecfilter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcreregex() substitution filter to corrupt memory and potentially execute code as root.
Affected Software
Event History
Frequently Asked Questions
What configuration is required for exploitation?
A PCRE2 substitution filter using pcre_regex() must be loaded. The vulnerable code path is reached by packets that match that filter.
Who can exploit this issue?
A network-adjacent attacker can trigger the flaw without privileges or user interaction by sending matching packets. Successful exploitation may corrupt memory and could lead to code execution as root.
How can I determine whether an instance is affected?
Instances running Ettercap through 0.8.4.1 are affected if they have a loaded pcre_regex() substitution filter. Review active filter configurations for PCRE2 substitution rules and compare the installed version to the affected range.