{"id":"CVE-2026-125400","published":"2026-11-10T00:17:14.387","lastModified":"2026-11-10T17:17:30.253","description":"Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_filter.c#L593-L625","tags":[]},{"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","tags":[]},{"url":"https://github.com/Ettercap/ettercap/pull/1330","tags":[]},{"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-f3j5-rhhr-85j5","tags":[]},{"url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-use-after-free-via-pcre2-filter-substitution","tags":[]}],"exploitRefs":[{"url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_filter.c#L593-L625","tags":[]},{"url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98","tags":[]},{"url":"https://github.com/Ettercap/ettercap/pull/1330","tags":[]},{"url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-f3j5-rhhr-85j5","tags":[]}],"hasPoc":true,"ai":{"summary":"Ettercap through 0.8.4.1 contains a use-after-free vulnerability in its PCRE2 regex substitution engine (func_pcre() in src/ec_filter.c), where match data is freed before the ovector is accessed, enabling memory corruption. Network-adjacent attackers can trigger this by sending packets that match a loaded pcre_regex() filter, potentially leading to arbitrary code execution with root privileges.","exploitability":"Exploitation requires network adjacency and delivery of specially crafted packets that match an active PCRE2 substitution filter; no authentication or user interaction is needed.","blast_radius":"Successful exploitation could allow full system compromise (confidentiality, integrity, and availability) as the attacker runs code with root privileges on the Ettercap host.","remediation":"Upgrade to Ettercap version 0.8.5 or later, which contains the fix for CVE-2026-125400.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["use-after-free","rce","ettercap","pcre","network-adjacent"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:48:33.162Z"}}