CVE-2026-121968 · Other
NO FIX YET · SEE WHAT TO DO
Netrek-client-cow through 3.3.3 mishandles SP_S_MESSAGE packets in short.c, reading memory past the players array when the recipient index is 36 or more. An attacker running a Netrek server, or intercepting the plaintext TCP connection, can crash the client and deny service.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Players and operators who connect the Netrek-client-cow client to Netrek servers, especially over untrusted networks or plaintext TCP. Clients that only connect to trusted servers on a private network face less exposure. The sources do not say whether a fixed version exists beyond a linked patch.
Not affected if private-network, trusted-server-only
Who cares games, netrek, netrek-client-cow
3.3.3).short.c handleSMessage() code path if you build the client from source.Patch linked at github.com; the fixed version is unknown from the sources.
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.