{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121969", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T12:48:39.813Z", "datePublished": "2026-11-04T20:36:47.609Z", "dateUpdated": "2026-11-05T19:27:21.478Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:47.609Z"}, "datePublic": "2026-11-03T00:00:00.000Z", "title": "netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage", "descriptions": [{"lang": "en", "value": "netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Stack-based Buffer Overflow", "cweId": "CWE-121", "type": "CWE"}]}], "affected": [{"vendor": "quozl", "product": "netrek-client-cow", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.3", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/quozl/netrek-client-cow", "tags": ["product"]}, {"url": "https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949", "tags": ["technical-description"]}, {"url": "https://github.com/quozl/netrek-client-cow/issues/11", "tags": ["issue-tracking"]}, {"name": "VulnCheck Advisory: netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"}], "credits": [{"lang": "en", "value": "Deus Rex", "type": "finder"}, {"lang": "en", "value": "James Cameron", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:27:04.770622Z", "id": "CVE-2026-121969", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:27:21.478Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "netrek-client-cow", "vendor": "quozl", "versions": [{"lessThanOrEqual": "3.3.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client."}], "id": "CVE-2026-121969", "lastModified": "2026-11-05T20:17:49.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121969", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:27:04.770622Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:06.840", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/quozl/netrek-client-cow"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/quozl/netrek-client-cow/issues/11"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "netrek-client-cow: netrek-client-cow: Denial of Service via stack-based buffer overflow in handleSMessage", "id": "2567675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567675"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.", "A flaw was found in netrek-client-cow. A stack-based buffer overflow vulnerability in the handleSMessage function allows a Denial of Service (DoS). A malicious server or a network attacker on an unencrypted connection can exploit this flaw by sending oversized or improperly terminated message packets. This corrupts stack memory and crashes the client application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121969", "public_date": "2026-11-04T20:36:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121969\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121969\nhttps://github.com/quozl/netrek-client-cow\nhttps://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949\nhttps://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127\nhttps://github.com/quozl/netrek-client-cow/issues/11\nhttps://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"], "statement": "This vulnerability is classified as Moderate rather than Important because exploitation requires user interaction to connect to an untrusted server or an adversary in a position to intercept plaintext traffic, with the impact confined to application termination. Furthermore, netrek-client-cow is not shipped or supported in any Red Hat enterprise offerings, leaving default environments unaffected.", "threat_severity": "Moderate"}

{"created": "2026-11-04T22:15:15.090519+00:00", "updated": "2026-11-06T15:15:05.440547+00:00", "vendors": []}