{"id":"CVE-2026-121969","kind":"vulnerability","aliases":["CVE-2026-121969"],"related":[],"title":"netrek-client-cow: stack overflow in message handling lets a server crash the client","description":"netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.","summary":"netrek-client-cow through 3.3.3 has a stack buffer overflow in handleSMessage() in short.c. A malicious Netrek server or an attacker on the plaintext connection can send oversized message packets that write server-controlled bytes onto the stack, crashing the client.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","netrek","netrek-client-cow","package"],"not_affected_if":["client-not-installed","trusted-network-only"],"how_to_check":"- Check the installed netrek-client-cow version against the sources; versions through `3.3.3` are affected.\n- Look for the `handleSMessage()` function in `short.c` in your build if you compile from source.","fix":"- Patch linked in the sources (github.com); the fixed version is not stated in the sources.","status":"open","published_at":"2026-11-04T21:18:06+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","triaged_at":"2026-11-04T21:50:59+00:00","updated_at":"2026-11-04T21:50:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T21:50:59Z","model":"claude-haiku-5-5","output":{"fix":"- Patch linked in the sources (github.com); the fixed version is not stated in the sources.","reach":"network","title":"netrek-client-cow: stack overflow in message handling lets a server crash the client","impact":"medium","summary":"netrek-client-cow through 3.3.3 has a stack buffer overflow in handleSMessage() in short.c. A malicious Netrek server or an attacker on the plaintext connection can send oversized message packets that write server-controlled bytes onto the stack, crashing the client.","audience":"developers","category":"package","nicknames":[],"who_cares":["netrek","netrek-client-cow","c"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"malicious server crashes the client and may write attacker-controlled bytes to stack","analyst_note":"Confirm the fixed version from the linked github.com patch; the sources do not name it.","how_to_check":"- Check the installed netrek-client-cow version against the sources; versions through `3.3.3` are affected.\n- Look for the `handleSMessage()` function in `short.c` in your build if you compile from source.","plain_action":"","needs_analyst":true,"not_affected_if":["client-not-installed","trusted-network-only"],"who_is_affected":"Players and operators who connect the netrek-client-cow client to Netrek servers, especially over untrusted networks where the plaintext TCP connection can be intercepted. Systems that never run this client or only connect to trusted servers are lower risk. The sources do not say which builds or platforms are most exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4221,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121969':18A,21A '-2026':17A,20A '100':97C '3.3.3':34B,77C 'allow':91C 'attack':50B 'base':82C 'bodi':129C 'buffer':38B,83C,100C 'byte':65B,98C,135C 'c':22B 'client':3A,15A,26B,31B,71B,74C,142C 'connect':54B,122C 'contain':78C 'control':64B,134C 'cow':4A,27B,32B,75C 'crash':13A,69B,140C 'cve':16A,19A 'handl':9A 'handlesmessag':41B,87C 'let':10A 'malici':45B,92C,109C 'man':114C 'man-in-the-middl':113C 'messag':8A,58B,106C,128C 'middl':117C 'netrek':2A,23B,25B,30B,46B,73C,110C 'netrek-client-cow':1A,24B,29B,72C 'onto':66B,136C 'overflow':6A,39B,84C,95C 'overlong':125C 'overs':57B,103C 'packag':28B 'packet':59B,107C 'plaintext':53B,120C 'send':56B,102C,124C 'server':12A,47B,63B,93C,111C,133C 'server-control':62B,132C 'short.c':43B,89C 'sp':104C 'stack':5A,37B,68B,81C,99C,138C 'stack-bas':80C 'tcp':121C 'untermin':127C 'vulner':85C 'write':61B,131C","nicknames":[],"mitigations":[],"who_affected":"Players and operators who connect the netrek-client-cow client to Netrek servers, especially over untrusted networks where the plaintext TCP connection can be intercepted. Systems that never run this client or only connect to trusted servers are lower risk. The sources do not say which builds or platforms are most exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","high","netrek","netrekclientcow","package"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121969","severity":null,"published_at":"2026-11-04T21:18:06+00:00","modified_at":"2026-11-04T21:18:06+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","fetched_at":"2026-11-04T21:49:18+00:00","note":null}],"documents":[{"id":70631,"url":"https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70634,"url":"https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}