CVE-2026-121968: Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked mrecpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SPSMESSAGE packets with mrecpt of 36 or more, reading past players[] and shipnos to deny service.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Netrek-client-cow through version 3.3.3 are exposed when they connect to a malicious Netrek server. Users may also be exposed if an attacker can intercept and modify the plaintext TCP connection to inject malicious packets.
What does an attacker need to do to trigger the vulnerability?
The attacker must cause the client to process an SP_S_MESSAGE packet with an m_recpt value of 36 or greater. This can be done by controlling the server or by altering traffic on the plaintext TCP connection.
What is the impact of successful exploitation?
A crafted packet causes an out-of-bounds read past the players[] and shipnos arrays and can crash the client. The provided information describes a denial-of-service impact, with no confidentiality or integrity impact indicated.