CVE-2026-125405: Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth() in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Ettercap through 0.8.4.1 are exposed when Ettercap observes HTTP traffic containing NTLM authentication data. The vulnerable parsing occurs in the HTTP dissector's handling of NTLM Authorization headers.
What does an attacker need to do to exploit it?
An attacker needs to cause Ettercap to observe a crafted HTTP Authorization header containing an NTLM message with unvalidated offsets. No privileges or user interaction are required according to the supplied vector.
What is the impact if exploitation succeeds?
The out-of-bounds read can disclose memory beyond the intended buffer or crash the Ettercap process. The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact.