CVE-2026-121969— netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
Quick assessment
Affected
quozl netrek-client-cow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
netrek-client-cow 3.3.3 及以下版本在 short.c 文件的 handleSMessage() 函数中存在基于栈的缓冲区溢出漏洞。恶意服务器可通过发送过大的 SP_S_MESSAGE 数据包，导致 100 字节的栈缓冲区溢出。在明文 TCP 连接中，恶意的 Netrek 服务器或中间人攻击者可以发送长度过长或未经正确终止的消息体，从而将受服务器控制的字节写入栈中，导致客户端崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-121969
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
Source: CVE Program / CVE List V5
Vulnerability Description
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| quozl | netrek-client-cow | 0 ~ 3.3.3 | - |
|
II. Public POCs for CVE-2026-121969
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-121969
请登录查看更多情报信息。
Other References for CVE-2026-121969 (5)
-
https://github.com/quozl/netrek-client-cow/issues/11 issue-tracking
-
https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949 technical-description
IV. Related Vulnerabilities
Same weakness: CWE-121
-
CVE-2026-113783
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP hand -
CVE-2026-113782
ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Ro -
CVE-2026-121925
Buffer overflow in SAML authentication post-back URL handlin -
CVE-2026-90628
Apache OpenOffice: Stack overflow in CFF hint handling -
CVE-2026-84730
ASUS 路由器固件堆栈缓冲区溢出漏洞