CVE-2026-129122 · Package
NO FIX YET · SEE WHAT TO DO
C-Kermit 6.0.192 through versions before 11.1.515 has a buffer overflow in its Telnet NEW-ENVIRON handling. A malicious or man-in-the-middle Telnet server can send oversized variable names before authentication, corrupting stack and heap memory in the client.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any team running C-Kermit's Telnet client to connect to remote hosts, especially to servers outside their control or across untrusted networks. The flaw is triggered by the server side, so a client that only talks to trusted Telnet hosts has much lower exposure. unknown whether the sources describe any other usage path.
Not affected if no-telnet-use, trusted-servers-only
Who cares c-kermit, linux, telnet, unix
kermit and check the version banner for a release earlier than 11.1.51511.1.515 or later (the fixed version named in the product range)C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.