Live › vulnerability › CVE-2026-121603
Solanum, an IRC server daemon, has a buffer overflow in its ms_kill() handler: a linked server sending a kill reason longer than KILLLEN overflows a static 512-byte buffer. The result is a crash of the ircd, and possibly remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Only servers running Solanum before commit 2ea1382 are exposed, and the attack needs a linked server under attacker control, a rogue or compromised peer. Networks that link only to fully trusted servers face much less risk. Teams that run their own IRC network should look at their server links.
No product ranges from the sources yet.
2ea1382; builds before that commit are exposed.2ea1382 or later (the patch linked from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-121603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.