# CVE-2026-125406: Ettercap stack buffer underwrite in telnet dissector

Source: https://junglewise.ai/threats/cve-2026-125406-ettercap-through-0-8-4-1-contains-a-stack-buffer-underwrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125406 · Severity: high · CVSS 8.8 · Published 2026-11-10

Ettercap is a network analysis tool that dissects and inspects traffic across a network. A flaw in its telnet protocol parser allows attackers to send specially crafted telnet streams that corrupt Ettercap's memory stack, potentially leading to a crash or arbitrary code execution, particularly dangerous since Ettercap typically runs with root privileges.

Technologies: [Ettercap](https://junglewise.ai/threats/technologies/ettercap-ettercap). Vendors: [Ettercap](https://junglewise.ai/threats/vendors/ettercap).

## Quick answers

**Is CVE-2026-125406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125406 being exploited in the wild.

**How severe is CVE-2026-125406?** High severity, with a CVSS score of 8.8, published 10 November 2026.

**Which products and versions are affected?** Ettercap through 0.8.4.1.

**Is there a fix for CVE-2026-125406?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125406 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125406?** Check whether you run Ettercap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack buffer underwrite vulnerability exists in the telnet dissector (src/dissectors/ec_telnet.c) that fails to validate the output pointer's lower bound when processing backspace characters. An attacker can send a telnet stream with more backspace characters than preceding characters to write below the buffer boundary, corrupting the stack frame of the Ettercap process. This is reachable over the network via crafted telnet packets without authentication.

## Affected products

- Ettercap Ettercap through 0.8.4.1

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c](https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/dissectors/ec_telnet.c)
- [https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98](https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98)

## Related threats

- [Ettercap out-of-bounds read in NTLM parsing](https://junglewise.ai/threats/cve-2026-125405-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read)
- [Ettercap integer underflow in CCMP decryption](https://junglewise.ai/threats/cve-2026-125404-ettercap-through-0-8-4-1-contains-an-integer-underflow-in-ccmp)
- [Ettercap out-of-bounds read in SSL header stripping](https://junglewise.ai/threats/cve-2026-125403-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read-and-size)
- [Ettercap heap buffer overflow in Gadu-Gadu dissector](https://junglewise.ai/threats/cve-2026-125401-ettercap-through-0-8-4-1-contains-a-heap-buffer-overflow)
- [Ettercap use-after-free in PCRE filter processing](https://junglewise.ai/threats/cve-2026-125400-ettercap-through-0-8-4-1-contains-a-use-after-free-vulnerability)