Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121968— Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Quick assessment

Affected
quozl netrek-client-cow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Netrek-client-cow 3.3.3 及更早版本在 short.c 的 handleSMessage() 函数中存在一个越界读取漏洞。该漏洞允许恶意服务器通过未检查的 m_recpt 索引导致客户端崩溃。控制 Netrek 服务器或拦截明文 TCP 连接的攻击者可以发送 m_recpt 值为 36 或更大的 SP_S_MESSAGE 数据包，从而读取 players[] 和 shipnos 数组之外的内存，造成拒绝服务（DoS）。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121968

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Source: CVE Program / CVE List V5
Vulnerability Description
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quozl netrek-client-cow 0 ~ 3.3.3 -

II. Public POCs for CVE-2026-121968

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121968

请登录查看更多情报信息。

Other References for CVE-2026-121968 (4)

IV. Related Vulnerabilities

Same product: netrek-client-cow
Same vendor: quozl
Same weakness: CWE-129