CVE-2026-125401: Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gggetversion() in src/dissectors/ecgg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ettercap installations through 0.8.4.1 are exposed when they monitor network traffic containing Gadu-Gadu traffic on TCP port 8074. The vulnerable dissector runs within the Ettercap process, which normally runs as root.
What does an attacker need to exploit it?
An attacker does not need privileges or user interaction. They need to send crafted Gadu-Gadu traffic with a malicious version field on TCP port 8074 through a network being monitored by Ettercap.
What can happen if exploitation succeeds?
The crafted version field can cause gg_get_version() to write up to 44 bytes into a 30-byte heap allocation, corrupting heap memory in the Ettercap process. The reported impact includes integrity and availability effects.