CVE-2026-125406: Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ectelnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ettercap installations through 0.8.4.1 are exposed when they process attacker-controlled Telnet traffic through the Telnet dissector. The impact is especially significant because the Ettercap process normally runs as root.
What does an attacker need to send to trigger the vulnerability?
An attacker needs to provide a Telnet stream containing more backspace characters than preceding characters. No authentication or user interaction is required according to the supplied CVSS vector.
What is the likely impact of successful exploitation?
The excessive backspaces can move the dissector output pointer below its stack buffer and corrupt the Ettercap process stack. The reported CVSS vector indicates high confidentiality, integrity, and availability impact.