CVE-2026-121969: netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SPSMESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of netrek-client-cow through version 3.3.3 are exposed when the client receives SP_S_MESSAGE packets from a malicious Netrek server or from an attacker able to intercept and modify its plaintext TCP connection.
What does an attacker need to exploit it?
The attacker needs to control a Netrek server the client connects to, or act as a man-in-the-middle on the plaintext TCP connection. They can then send an oversized or unterminated SP_S_MESSAGE body to overflow the stack buffer.
What can be done before a fix is deployed?
Avoid connecting affected clients to untrusted Netrek servers. Use only trusted network paths and servers to reduce the risk of a man-in-the-middle modifying the plaintext TCP traffic.