# CVE-2026-125404: Ettercap integer underflow in CCMP decryption

Source: https://junglewise.ai/threats/cve-2026-125404-ettercap-through-0-8-4-1-contains-an-integer-underflow-in-ccmp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125404 · Severity: high · CVSS 7.5 · Published 2026-11-10

Ettercap is a network security tool that captures and analyzes encrypted wireless traffic. An attacker with access to a WPA-protected network can send a specially crafted wireless frame that causes Ettercap to crash or execute arbitrary code with root privileges, since Ettercap typically runs with elevated permissions.

Technologies: [Ettercap](https://junglewise.ai/threats/technologies/ettercap-ettercap). Vendors: [Ettercap](https://junglewise.ai/threats/vendors/ettercap).

## Quick answers

**Is CVE-2026-125404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125404 being exploited in the wild.

**How severe is CVE-2026-125404?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Ettercap through 0.8.4.1.

**Is there a fix for CVE-2026-125404?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125404 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125404?** Check whether you run Ettercap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the ccmp_decrypt() function in src/ec_encryption_ccmp.c, where the code subtracts the 8-byte CCMP trailer from the packet length without validating that the packet is long enough. An attacker who knows the WPA key (or is on the same network where Ettercap has been configured with the key) can send a short CCMP frame to trigger a stack buffer overflow. This occurs via network attack vector with the precondition of WPA key knowledge, and exploiting it grants code execution in the Ettercap process running as root.

## Affected products

- Ettercap Ettercap through 0.8.4.1

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_encryption_ccmp.c](https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_encryption_ccmp.c)
- [https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98](https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98)

## Related threats

- [Ettercap stack buffer underwrite in telnet dissector](https://junglewise.ai/threats/cve-2026-125406-ettercap-through-0-8-4-1-contains-a-stack-buffer-underwrite)
- [Ettercap out-of-bounds read in NTLM parsing](https://junglewise.ai/threats/cve-2026-125405-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read)
- [Ettercap out-of-bounds read in SSL header stripping](https://junglewise.ai/threats/cve-2026-125403-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read-and-size)
- [Ettercap heap buffer overflow in Gadu-Gadu dissector](https://junglewise.ai/threats/cve-2026-125401-ettercap-through-0-8-4-1-contains-a-heap-buffer-overflow)
- [Ettercap use-after-free in PCRE filter processing](https://junglewise.ai/threats/cve-2026-125400-ettercap-through-0-8-4-1-contains-a-use-after-free-vulnerability)