DEBIAN-CVE-2026-125401: Buffer Overflow
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gggetversion() in src/dissectors/ecgg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use Ettercap to monitor network traffic and can observe Gadu-Gadu traffic on TCP port 8074 are exposed. The vulnerable dissector is reached through monitored traffic, and the Ettercap process normally runs as root.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to send Gadu-Gadu traffic with a crafted version field on TCP port 8074 through a network being monitored by Ettercap.
What is the likely impact of successful exploitation?
The crafted version field can corrupt heap memory in the Ettercap process. Because Ettercap normally runs as root, successful exploitation could affect the integrity and availability of the host running it.