CVE-2026-121969: falha de alta gravidade em quozl netrek-client-cow
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
quozl · netrek-client-cowCVEs relacionadas — quozl netrek-client-cow
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/quozl/netrek-client-cowhttps://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127https://github.com/quozl/netrek-client-cow/issues/11https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage