CVE-2026-125402: Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslwgetclienthellosni() in src/ecsslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Ettercap versions through 0.8.4.1 are affected when they perform SSL interception and process TLS ClientHello messages from a network-adjacent attacker.
What does an attacker need to exploit this issue?
An attacker needs network-adjacent access and must send a crafted TLS ClientHello during SSL interception. The supplied vector indicates no privileges or user interaction are required.
What is the likely impact of successful exploitation?
A successful attack can leak up to 64 KB of heap memory upstream or cause Ettercap to crash. The issue is an out-of-bounds read caused by an unchecked 16-bit SNI length field.
How can I check whether an installation is affected?
Check whether the installation runs Ettercap 0.8.4.1 or an earlier version and is configured to intercept SSL/TLS traffic. Affected code is in sslw_get_clienthello_sni() in src/ec_sslwrap.c.