---
id: "CVE-2026-121968"
kind: "vulnerability"
aliases: ["CVE-2026-121968"]
title: "Netrek-client-cow: out-of-bounds read lets a malicious server crash clients"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["games", "netrek", "netrek-client-cow", "other"]
not_affected_if: ["private-network", "trusted-server-only"]
published_at: "2026-11-04T21:18:06+00:00"
first_seen_at: "2026-11-04T21:49:18+00:00"
updated_at: "2026-11-04T21:51:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121968", "first_seen_at": "2026-11-04T21:49:18+00:00"}]
exploit_sources: []
---

# Netrek-client-cow: out-of-bounds read lets a malicious server crash clients

Netrek-client-cow through 3.3.3 mishandles SP_S_MESSAGE packets in short.c, reading memory past the players array when the recipient index is 36 or more. An attacker running a Netrek server, or intercepting the plaintext TCP connection, can crash the client and deny service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Netrek-client-cow version against the affected range (through `3.3.3`).
- Look for the `short.c` handleSMessage() code path if you build the client from source.

## Fix

Patch linked at github.com; the fixed version is unknown from the sources.

## Timeline

- 2026-11-04T21:49:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121968

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-out-of-bounds-read-via-sp-s-message-packets
- [fix] Patch: github.com https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127

## From the sources

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_