Vulnerability record/PUBLISHED/Published Nov 9, 2026 23:28:04 UTC
CVE-2026-125403
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
Base score7.2/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorAdjacentAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 9, 2026 23:28:04 UTC
PublishedNov 9, 2026 23:28:04 UTC
ReservedNov 9, 2026 22:03:16 UTC
Credits
- Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon (DREAM Security Research Team)
- Emilio Escobar