Ettercap: Integer underflow in ccmp_decrypt (CVE-2026-125404)
Ettercap versions through 0.8.4.1 contain an integer underflow in the ccmp_decrypt function that can result in a stack buffer overflow.
CVE search metadata
CVE search record: CVE-2026-125404. Severity: high. CVSS: 7.5. KEV: no. Product: Ettercap <= 0.8.4.1 (<= 0.8.4.1). Brief: Ettercap: Integer underflow in ccmp_decrypt (CVE-2026-125404). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ettercap-integer-underflow/
Triage facts
Revision 1- Applicability
- Ettercap <= 0.8.4.1 (<= 0.8.4.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 02:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Ettercap versions through 0.8.4.1 contain an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c due to a failure to check the minimum length when subtracting the 8-byte CCMP trailer. Attackers on a network where the WPA key is loaded can send a short, crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.