CVE-2026-3606

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3606", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-05T16:55:18.903Z", "datePublished": "2026-03-05T22:02:07.360Z", "dateUpdated": "2026-03-09T18:19:35.860Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-05T22:02:07.360Z"}, "title": "Ettercap etterfilter ef_output.c add_data_segment out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "Ettercap", "versions": [{"version": "0.8.4-Garofalo", "status": "affected"}], "cpes": ["cpe:2.3:a:ettercap:ettercap:*:*:*:*:*:*:*:*"], "modules": ["etterfilter"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-05T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-05T18:00:24.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Oneafter (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.349218", "name": "VDB-349218 | Ettercap etterfilter ef_output.c add_data_segment out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349218", "name": "VDB-349218 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.764648", "name": "Submit #764648 | Ettercap ettercap Ettercap v0.8.4-Garofalo and master-branch Heap-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Ettercap/ettercap/issues/1297", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0202/blob/main/et/repro", "tags": ["exploit"]}, {"url": "https://github.com/Ettercap/ettercap/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T18:19:19.314251Z", "id": "CVE-2026-3606", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:19:35.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3606", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T18:19:19.314251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:19:30.673Z"}}], "cna": {"title": "Ettercap etterfilter ef_output.c add_data_segment out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "Oneafter (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:ettercap:ettercap:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["etterfilter"], "product": "Ettercap", "versions": [{"status": "affected", "version": "0.8.4-Garofalo"}]}], "timeline": [{"lang": "en", "time": "2026-03-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-05T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-05T18:00:24.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349218", "name": "VDB-349218 | Ettercap etterfilter ef_output.c add_data_segment out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349218", "name": "VDB-349218 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.764648", "name": "Submit #764648 | Ettercap ettercap Ettercap v0.8.4-Garofalo and master-branch Heap-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Ettercap/ettercap/issues/1297", "tags": ["issue-tracking"]}, {"url": "https://github.com/oneafter/0202/blob/main/et/repro", "tags": ["exploit"]}, {"url": "https://github.com/Ettercap/ettercap/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-05T22:02:07.360Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3606", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:19:35.860Z", "dateReserved": "2026-03-05T16:55:18.903Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-05T22:02:07.360Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ettercap:ettercap:*:*:*:*:*:*:*:*"], "modules": ["etterfilter"], "product": "Ettercap", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.8.4-Garofalo"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ettercap-project:ettercap:0.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "813AA945-FA52-4AAE-86B7-6C55B54ABDAE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Ettercap 0.8.4-Garofalo. Afectada por esta vulnerabilidad es la funci\u00f3n add_data_segment del archivo src/ettercap/utils/etterfilter/ef_output.c del componente etterfilter. La manipulaci\u00f3n conduce a una lectura fuera de l\u00edmites. Se requiere acceso local para abordar este ataque. El exploit ha sido revelado al p\u00fablico y puede ser usado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero no ha respondido a\u00fan."}], "id": "CVE-2026-3606", "lastModified": "2026-06-17T10:43:51.497", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 1.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3606", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T18:19:19.314251Z", "version": "2.0.3"}}]}, "published": "2026-03-05T22:16:25.390", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/Ettercap/ettercap/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/Ettercap/ettercap/issues/1297"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/oneafter/0202/blob/main/et/repro"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.349218"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.349218"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.764648"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "Ettercap: Ettercap: Denial of Service via out-of-bounds read in etterfilter", "id": "2445008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445008"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Ettercap. A local user can exploit an out-of-bounds read vulnerability within the `add_data_segment` function of the `etterfilter` component. By manipulating input, an attacker can trigger this flaw, potentially leading to a denial of service."], "name": "CVE-2026-3606", "public_date": "2026-03-05T22:02:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3606\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3606\nhttps://github.com/Ettercap/ettercap/\nhttps://github.com/Ettercap/ettercap/issues/1297\nhttps://github.com/oneafter/0202/blob/main/et/repro\nhttps://vuldb.com/?ctiid.349218\nhttps://vuldb.com/?id.349218\nhttps://vuldb.com/?submit.764648"], "statement": "This MODERATE vulnerability in Ettercap's etterfilter component allows a local authenticated user to trigger an out-of-bounds read. Exploitation requires local access and low privileges, with low impact to confidentiality and availability. Red Hat products are affected if Ettercap is installed.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.8.4-Garofalo"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Ettercap", "source": "cna", "vendor": "n/a"}, "product": "ettercap", "vendor": "ettercap"}], "analysis": {"en": {"generated_at": "2026-04-16T11:52:38.965203+00:00", "value": {"mitigation_remediation": ["Apply an updated version of Ettercap that contains the fix for add_data_segment", "Limit local access to the Ettercap service to trusted administrators or privileged users", "Monitor system logs for attempts to read beyond expected buffer boundaries or unusual memory access patterns"], "summary": {"action": "Patch promptly", "impact": "Information disclosure via out-of-bounds memory read"}, "threat_synthesis": {"affected_systems": "The issue affects Ettercap versions identified by the CPE strings, specifically version 0.8.4 of the Ettercap project. No other affected versions are listed in the available CNA data, so users of 0.8.4 should consider upgrading or disabling the vulnerable component.", "description_and_impact": "The vulnerability resides in the add_data_segment function of Ettercap\u2019s ef_output.c file, enabling an out-of-bounds read that can expose sensitive data from the process\u2019s memory. The flaw allows an attacker who can execute commands locally on the host running Ettercap to read beyond the intended buffer limits, potentially revealing configuration details or captured network traffic. While this does not lead to remote code execution or privilege escalation, the material that can be retrieved may contain confidential information, compromising confidentiality of the compromised system.", "risk_and_exploitability": "With a CVSS score of 4.8 and an EPSS probability of less than 1%, the vulnerability presents a moderate severity that is unlikely to be widely exploited, especially since it requires local access. It is not listed in the CISA KEV catalog, indicating no confirmed exploitation. Nevertheless, because the flaw permits leakage of potentially sensitive data, the risk is significant enough to warrant remediation as a priority, especially for systems handling critical network traffic."}}}}, "created": "2026-03-06T14:56:45.385766+00:00", "updated": "2026-04-16T12:00:11.692033+00:00", "vendors": ["ettercap", "ettercap$PRODUCT$ettercap"]}