CVE-2026-125403 Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125403?
CVE-2026-125403 is a high-severity vulnerability in ettercap, published on 9 Nov 2026.
Official description
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
Weakness: CWE-125
Which versions are affected by CVE-2026-125403?
How do I fix CVE-2026-125403?
No fix has been published for CVE-2026-125403 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125403 being exploited?
There is no known exploitation of CVE-2026-125403 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125403, GHSA-74xr-8gm8-4rwv, GHSA-hq2w-pg4m-6w63, UBUNTU-CVE-2026-125403.