CVE-2026-125400

HIGH 8.8

Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.

CWE	CWE-416
Vendor	ettercap
Product	ettercap
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for ettercap ettercap

Be the first to know when new high vulnerabilities affecting ettercap ettercap are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Ettercap / ettercap

0 ≤ 0.8.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Ettercap/ettercap/security/advisories/GHSA-f3j5-rhhr-85j5 github.com: https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98 github.com: https://github.com/Ettercap/ettercap/pull/1330 github.com: https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_filter.c#L593-L625 vulncheck.com: https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-use-after-free-via-pcre2-filter-substitution

Credits

Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon (DREAM Security Research Team) Emilio Escobar