DEBIAN-CVE-2026-125400: Use After Free
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in funcpcre() in src/ecfilter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcreregex() substitution filter to corrupt memory and potentially execute code as root.
Affected Software
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
Systems running Ettercap through 0.8.4.1 are exposed when a pcre_regex() substitution filter is loaded. The vulnerable path is reached by packets that match that filter.
Does an attacker need credentials or user interaction to exploit this?
No. The reported attack vector is network-adjacent, with no privileges or user interaction required.
What is the potential impact of successful exploitation?
A matching packet can trigger memory corruption through the use-after-free condition. The issue may allow code execution as root, with high confidentiality, integrity, and availability impact.