UBUNTU-CVE-2026-125404: High severity ubuntu/ettercap vulnerability
Ettercap through 0.8.4.1 contains an integer underflow in ccmpdecrypt() in src/ecencryptionccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running Ettercap through 0.8.4.1 are exposed when Ettercap is processing CCMP traffic on a network for which the WPA key has been loaded. The impact is especially severe because the Ettercap process normally runs as root.
What does an attacker need to exploit this issue?
An attacker must be able to send a crafted short CCMP frame on the relevant network. The target Ettercap instance must have the WPA key for that network loaded.
How can I determine whether my deployment is affected?
Check whether Ettercap is version 0.8.4.1 or earlier and whether it is being used to process CCMP traffic with WPA keys loaded. Such deployments meet the stated exposure conditions.