Vulnerability record/PUBLISHED/Published Nov 9, 2026 23:28:03 UTC
CVE-2026-125401
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.
Base score7.2/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorAdjacentAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 9, 2026 23:28:03 UTC
PublishedNov 9, 2026 23:28:03 UTC
ReservedNov 9, 2026 22:03:15 UTC
Credits
- Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon (DREAM Security Research Team)
- Emilio Escobar