GHSA-f3j5-rhhr-85j5: Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
Published Nov 9, 2026
·Updated
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in funcpcre() in src/ecfilter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcreregex() substitution filter to corrupt memory and potentially execute code as root.
Affected Software
1 affected component
Ettercap Ettercap<=0.8.4.1
Event History
Nov 9, 2026
CVE Published
via OSV·11:28 PM
Data Sourced
via OSV·11:28 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions are required for exploitation?
An attacker must be network-adjacent and able to send packets that match a loaded pcre_regex() substitution filter. No privileges or user interaction are required.
2
Which deployments are most exposed?
Deployments running Ettercap through 0.8.4.1 with a PCRE2 substitution filter loaded are exposed to the described attack path. The vulnerable code can process matching network packets and may allow memory corruption or code execution as root.