CVE-2026-9365: Heap-based Buffer Overflow in Ettercap
A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.4 is sufficient to fix this issue. The identifier of the patch is feeae6fa366e01a3dd9f1857ec6aae847b2ae00c. It is suggested to upgrade the affected component.
AI Analysis
Technical Summary
This vulnerability involves a heap-based buffer overflow in the FUNC_DECODER function of the GG Dissector component (src/dissectors/ec_gg.c) in Ettercap versions 0.8.0 through 0.8.3. The flaw is triggered by improper handling of the gg argument, allowing remote attackers to cause a buffer overflow condition on the heap. The attack complexity is high and no privileges or user interaction are required. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. A patch identified by commit feeae6fa366e01a3dd9f1857ec6aae847b2ae00c is available in version 0.8.4.
Potential Impact
Successful exploitation can lead to heap-based buffer overflow, potentially causing application crashes or arbitrary code execution. The vulnerability is remotely exploitable without privileges or user interaction, but the attack complexity is high and exploitability is difficult. Public exploit code exists, increasing risk if unpatched.
Mitigation Recommendations
Upgrade Ettercap to version 0.8.4 or later, which includes the official fix for this vulnerability (patch feeae6fa366e01a3dd9f1857ec6aae847b2ae00c). No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's release notes.
CVE-2026-9365: Heap-based Buffer Overflow in Ettercap
Description
A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.4 is sufficient to fix this issue. The identifier of the patch is feeae6fa366e01a3dd9f1857ec6aae847b2ae00c. It is suggested to upgrade the affected component.
CVSS v4.0
Score 6.3medium
Affected software
pkg:github/ettercap/ettercapRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a heap-based buffer overflow in the FUNC_DECODER function of the GG Dissector component (src/dissectors/ec_gg.c) in Ettercap versions 0.8.0 through 0.8.3. The flaw is triggered by improper handling of the gg argument, allowing remote attackers to cause a buffer overflow condition on the heap. The attack complexity is high and no privileges or user interaction are required. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. A patch identified by commit feeae6fa366e01a3dd9f1857ec6aae847b2ae00c is available in version 0.8.4.
Potential Impact
Successful exploitation can lead to heap-based buffer overflow, potentially causing application crashes or arbitrary code execution. The vulnerability is remotely exploitable without privileges or user interaction, but the attack complexity is high and exploitability is difficult. Public exploit code exists, increasing risk if unpatched.
Mitigation Recommendations
Upgrade Ettercap to version 0.8.4 or later, which includes the official fix for this vulnerability (patch feeae6fa366e01a3dd9f1857ec6aae847b2ae00c). No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's release notes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-23T10:28:40.541Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a12b3e909f6977edb39e515
Added to database: 05/24/2026, 08:16:41 UTC
Last enriched: 05/31/2026, 20:37:58 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.