CVE-2026-121969 netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage

High 7.1 Published 4 Nov 2026 Updated 5 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-121969?

CVE-2026-121969 is a high-severity vulnerability in quozl netrek-client-cow, published on 4 Nov 2026.

Official description

netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.

Weakness: CWE-121

Which versions are affected by CVE-2026-121969?

How do I fix CVE-2026-121969?

No fix has been published for CVE-2026-121969 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-121969 being exploited?

There is no known exploitation of CVE-2026-121969 in the wild and no public exploit code.

Sources

Also known as GHSA-2v39-q9qf-3m9g, UBUNTU-CVE-2026-121969.