CVE-2026-125400

Summary

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in its PCRE2 regex substitution engine (func_pcre() in src/ec_filter.c), where match data is freed before the ovector is accessed, enabling memory corruption. Network-adjacent attackers can trigger this by sending packets that match a loaded pcre_regex() filter, potentially leading to arbitrary code execution with root privileges.

Exploitability

Exploitation requires network adjacency and delivery of specially crafted packets that match an active PCRE2 substitution filter; no authentication or user interaction is needed.

Blast radius

Successful exploitation could allow full system compromise (confidentiality, integrity, and availability) as the attacker runs code with root privileges on the Ettercap host.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ettercap version 0.8.5 or later, which contains the fix for CVE-2026-125400.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.