UBUNTU-CVE-2026-125400: Use After Free
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in funcpcre() in src/ecfilter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcreregex() substitution filter to corrupt memory and potentially execute code as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of Ettercap through 0.8.4.1 are exposed when a pcre_regex() substitution filter is loaded and can receive matching network packets. The issue is network-adjacent, so an attacker must be able to send traffic to the affected Ettercap instance.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated. Exploitation is described as requiring packets that match a loaded pcre_regex() substitution filter.
What is the likely impact if exploitation succeeds?
A successful attack can corrupt memory and may allow code execution as root. Confidentiality, integrity, and availability are all rated high impact.
What can be done before a fix is available?
Avoid loading pcre_regex() substitution filters on exposed Ettercap deployments, particularly where untrusted or network-adjacent systems can send matching traffic. Review active filters and the network sources able to reach the instance.
How can I identify potentially affected systems?
Check whether the installed Ettercap version is 0.8.4.1 or earlier, and inspect configured or loaded filters for pcre_regex() substitution rules. Systems without such a loaded filter are not described as meeting the exploitation condition.