EUVD-2026-31576
GHSA-fgvc-qw77-cmcj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.4 is sufficient to fix this issue. The identifier of the patch is feeae6fa366e01a3dd9f1857ec6aae847b2ae00c. It is suggested to upgrade the affected component.
AnalysisAI
Heap-based buffer overflow in Ettercap's GG protocol dissector (versions up to 0.8.3) allows remote attackers to potentially achieve limited confidentiality, integrity, and availability compromise through crafted network traffic. The vulnerability exists in the ec_gg.c dissector when processing Gadu-Gadu instant messaging protocol packets. Publicly available exploit code exists (GitHub issue #1306), and vendor has released patch version 0.8.4 (commit feeae6fa). Despite network attack vector, exploitation difficulty is high (AC:H) with low EPSS risk, suggesting specialized targeting rather than mass exploitation.
Technical ContextAI
Ettercap is a comprehensive network interception and analysis suite for man-in-the-middle attacks on LANs. The vulnerability resides in the GG (Gadu-Gadu) protocol dissector component (src/dissectors/ec_gg.c), which parses instant messaging traffic. CWE-122 identifies this as a heap-based buffer overflow, occurring when FUNC_DECODER processes malformed GG protocol packets. The patch reveals multiple unsafe strncpy operations copying user-controlled description fields into fixed 71-byte buffers without proper bounds checking. The dissector processes GG_LOGIN50_CMD, GG_LOGIN60_CMD, GG_LOGIN70_CMD, and GG_STATUS commands, calculating copy lengths as (gg->len - offset) without validating that gg->len exceeds the offset, leading to integer underflow and excessive copy lengths. The fix introduces GG_MAX_LEN constant (70 bytes), proper offset validation, and MIN() macro to constrain copy operations.
RemediationAI
Upgrade to Ettercap version 0.8.4 or later, which includes the vendor-released patch (commit feeae6fa366e01a3dd9f1857ec6aae847b2ae00c) fixing the buffer overflow in the GG dissector. Patch details: https://github.com/Ettercap/ettercap/pull/1307 and https://github.com/Ettercap/ettercap/commit/feeae6fa366e01a3dd9f1857ec6aae847b2ae00c. If immediate patching is not feasible, implement the following compensating controls with noted trade-offs: (1) Disable the GG dissector module if Gadu-Gadu protocol analysis is not operationally required - reduces attack surface but eliminates visibility into GG traffic; (2) Run Ettercap only on isolated analysis networks separate from untrusted traffic sources - limits exposure but constrains operational flexibility; (3) Apply strict input validation at network boundaries to filter malformed GG protocol packets before they reach Ettercap - requires deep packet inspection capabilities and may introduce performance overhead or false positives blocking legitimate traffic. Organizations using Ettercap for production security monitoring should prioritize immediate upgrade to 0.8.4.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today