Ettercap: Stack buffer underwrite in telnet dissector (CVE-2026-125406)

Ettercap versions through 0.8.4.1 contain a stack buffer underwrite vulnerability in the telnet dissector located in 'src/dissectors/ec_telnet.c'. The vulnerability exists because the software fails to perform a lower bound check when decrementing the output pointer in response to a backspace character. An attacker providing a malicious telnet stream containing more backspaces than preceding characters can write data below the intended stack buffer.

Impact

Successful exploitation allows for memory corruption within the Ettercap process. As Ettercap is frequently executed with root privileges, this vulnerability poses a high risk of arbitrary code execution or denial of service through process crashes.

Recommendation

• Audit infrastructure to identify and inventory all instances of Ettercap 0.8.4.1 or earlier.
• Prioritize the isolation of systems running Ettercap in untrusted network environments until a patched version is available.
• Implement network-level inspection to identify anomalous telnet traffic patterns (excessive backspace characters) directed at systems running Ettercap.