CVE-2026-125404: Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption
Ettercap through 0.8.4.1 contains an integer underflow in ccmpdecrypt() in src/ecencryptionccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to Ettercap instances that have a WPA key loaded and process CCMP traffic. The affected range includes versions through 0.8.4.1.
What access does an attacker need?
The attacker must be on a network where the target Ettercap instance has the relevant WPA key loaded and must be able to send a crafted short CCMP frame. No privileges or user interaction are required, but exploitation has high attack complexity.
What is the likely impact if exploitation succeeds?
Successful exploitation can overflow a stack buffer in the Ettercap process and affect confidentiality, integrity, and availability. The process normally runs as root, increasing the potential impact.