CVE-2026-121968: falha de alta gravidade em quozl netrek-client-cow
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
quozl · netrek-client-cowCVEs relacionadas — quozl netrek-client-cow
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/quozl/netrek-client-cowhttps://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L942-L943https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-out-of-bounds-read-via-sp-s-message-packets