Two high-severity security flaws have been disclosed in Ettercap, the open-source network analysis tool, and both could let an attacker run code with root privileges on a machine running the software. The flaws, tracked as CVE-2026-125401 and CVE-2026-125400, were published on 10 November 2026 and affect Ettercap through version 0.8.4.1.

Ettercap is a long-established tool used by security professionals to monitor traffic on local networks. Because it normally runs as root, a memory-corruption flaw in the tool is far more dangerous than the same bug in an ordinary application: code execution inside Ettercap means code execution as the most privileged user on the system.

What the two flaws do

The first flaw, CVE-2026-125401, is a heap buffer overflow in the tool's Gadu-Gadu dissector, the code that inspects traffic from the Gadu-Gadu messaging protocol. The vulnerable function, gg_get_version() in src/dissectors/ec_gg.c, writes up to 44 bytes into a 30-byte allocation. A remote attacker can trigger the flaw by sending Gadu-Gadu traffic with a crafted version field over TCP port 8074 through a network Ettercap is monitoring. The overflow corrupts heap memory in the Ettercap process. It carries a CVSS score of 8.1, rated high.

The second flaw, CVE-2026-125400, is a use-after-free vulnerability in func_pcre() in src/ec_filter.c. The code reads the PCRE2 ovector after the underlying match data has been freed. A network-adjacent attacker can trigger it by sending packets that match a loaded pcre_regex() substitution filter, corrupting memory and potentially executing code as root. It carries a CVSS score of 8.8, also rated high.

Who found the flaws

Both flaws were credited to the DREAM Security research team - Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel and Shir Sadon - along with researcher Emilio Escobar. The fixes were committed to the Ettercap project on GitHub, and the vulnerability records were received on 10 November 2026.

As of publication, no public exploit code has been confirmed for either flaw, and neither vulnerability is recorded in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. That does not mean the risk is theoretical: the flaws are now public, the vulnerable code is identified, and Ettercap's root privileges make it an attractive target.

Who is at risk

Anyone running Ettercap 0.8.4.1 or earlier is affected. The heap overflow can be reached by a remote attacker sending crafted traffic through a monitored network, while the use-after-free flaw needs an attacker positioned on or adjacent to that network with packets matching a loaded filter. Security teams that run Ettercap on shared or untrusted networks, for example during penetration tests or incident response on a compromised network, face the greatest exposure.

What to do now

Users should update Ettercap to a version containing the fix as soon as their distribution makes it available, and check the project's GitHub repository for the patched release. Until the update is installed, the safest step is to avoid running Ettercap on networks that cannot be trusted, and to limit which networks and hosts the tool monitors. Organisations that used Ettercap during recent security work should also review whether any untrusted traffic passed through a monitored network while a vulnerable version was running.

The disclosure is a reminder that security tools themselves need the same patching discipline as the systems they protect. A flaw in a tool that runs as root hands an attacker the highest privilege on the machine, which is exactly why researchers keep auditing tools like Ettercap, and why users should treat updates to them as urgent.