DEBIAN-CVE-2026-125404: High severity debian/ettercap vulnerability
Ettercap through 0.8.4.1 contains an integer underflow in ccmpdecrypt() in src/ecencryptionccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ettercap installations processing CCMP traffic are exposed when the relevant WPA key is loaded. The attacker must be on the network and able to send crafted CCMP frames to the Ettercap process.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. Exploitation has high attack complexity and requires network-adjacent access.
What is the likely impact if exploitation succeeds?
A short crafted CCMP frame can trigger a stack buffer overflow in the Ettercap process. Because Ettercap normally runs as root, successful exploitation may compromise confidentiality, integrity, and availability at that privilege level.