CVE-2026-121968 Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

High 7.1 Published 4 Nov 2026 Updated 5 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-121968?

CVE-2026-121968 is a high-severity vulnerability in quozl netrek-client-cow, published on 4 Nov 2026.

Official description

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

Weakness: CWE-129

Which versions are affected by CVE-2026-121968?

How do I fix CVE-2026-121968?

No fix has been published for CVE-2026-121968 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-121968 being exploited?

There is no known exploitation of CVE-2026-121968 in the wild and no public exploit code.

Sources

Also known as GHSA-353f-5249-rrrg, UBUNTU-CVE-2026-121968.