Ettercap: Out-of-bounds read vulnerability in NTLM authentication (CVE-2026-125405)

Ettercap versions through 0.8.4.1 are susceptible to an out-of-bounds read vulnerability within the Parse_NTLM_Auth() function located in src/dissectors/ec_http.c. The vulnerability stems from improper validation of NTLM message offsets when the tool processes HTTP Authorization headers. A remote attacker can exploit this by sending a specially crafted HTTP request observed by the target Ettercap instance. Depending on the memory layout, this may lead to sensitive information disclosure or a denial-of-service condition via process termination.

Impact

Successful exploitation allows for the disclosure of arbitrary process memory or a crash of the Ettercap process, potentially disrupting network traffic interception or analysis tasks.

Recommendation

• Inventory environments where Ettercap 0.8.4.1 or earlier is deployed for network monitoring or security testing.
• Monitor for updates from the Ettercap project and upgrade to the patched version once released.
• Restrict network access to monitoring instances to only trusted sources to mitigate the risk of an attacker sending malicious HTTP headers to be processed by the tool.