{"id":"CVE-2026-129123","kind":"vulnerability","aliases":["CVE-2026-129123"],"related":[],"title":"C-Kermit: FTP client buffer overflow lets a malicious server overwrite memory","description":"C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.","summary":"C-Kermit's FTP client mishandles overlong security replies from a server, overflowing a fixed buffer in getreply() in ckcftp.c. A malicious or intercepted FTP server can overwrite client memory with attacker-controlled bytes.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"C-Kermit","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c-kermit","ftp-client","linux","package"],"not_affected_if":["no-ftp-client-use","trusted-servers-only"],"how_to_check":"- Run `kermit` and check the version banner for C-Kermit 8.0.200 through 11.1.514.\n- Check whether the build uses FTP with AUTH TLS, GSSAPI, Kerberos 4 or SRP support, which the description names as the trigger paths.","fix":"- C-Kermit: `11.1.515`","status":"open","published_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:48:39+00:00","updated_at":"2026-11-13T17:48:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T17:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: `11.1.515`","reach":"network","title":"C-Kermit: FTP client buffer overflow lets a malicious server overwrite memory","impact":"high","summary":"C-Kermit's FTP client mishandles overlong security replies from a server, overflowing a fixed buffer in getreply() in ckcftp.c. A malicious or intercepted FTP server can overwrite client memory with attacker-controlled bytes.","audience":"developers","category":"package","nicknames":[],"who_cares":["c-kermit","ftp-client","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"malicious FTP server overwrites client memory, possibly running code","analyst_note":"","how_to_check":"- Run `kermit` and check the version banner for C-Kermit 8.0.200 through 11.1.514.\n- Check whether the build uses FTP with AUTH TLS, GSSAPI, Kerberos 4 or SRP support, which the description names as the trigger paths.","plain_action":"","product_name":"C-Kermit","needs_analyst":false,"not_affected_if":["no-ftp-client-use","trusted-servers-only"],"who_is_affected":"Teams that run C-Kermit as an FTP client against servers they do not fully control, or over networks where traffic can be intercepted. The description names AUTH TLS (PBSZ replies) and GSSAPI, Kerberos 4 and SRP builds (ADAT replies) as the paths. Systems that never use C-Kermit's FTP client can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4713,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129123':16A,19A '-2026':15A,18A '11.1.515':72C '4':118C '8.0.200':70C 'adat':113C 'allow':83C 'attack':64B,96C,129C 'attacker-control':63B,128C 'auth':109C 'buf':126C 'buffer':6A,47B,75C 'build':121C 'byte':66B,131C 'c':2A,21A,24B,32B,68C 'c-kermit':1A,20A,23B,31B,67C 'ckcftp.c':51B,81C 'client':5A,28B,36B,60B,89C 'contain':73C 'control':65B,97C,130C 'cve':14A,17A 'fix':46B 'ftp':4A,27B,35B,56B,85C,101C 'ftp-client':26B 'getrepli':49B,79C 'gssapi':116C 'intercept':55B,99C 'kerbero':117C 'kermit':3A,22A,25B,33B,69C 'let':8A 'linux':29B 'long':105C,112C 'malici':10A,53B,84C 'memori':13A,61B,90C 'mishandl':37B 'overflow':7A,44B,76C,122C 'overlong':38B,93C 'overwrit':12A,59B,88C 'packag':30B 'pbsz':106C 'repli':40B,95C,107C,114C,125C 'secur':39B,94C 'send':92C,104C 'server':11A,43B,57B,86C,102C 'srp':120C 'static':124C 'tls':110C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run C-Kermit as an FTP client against servers they do not fully control, or over networks where traffic can be intercepted. The description names AUTH TLS (PBSZ replies) and GSSAPI, Kerberos 4 and SRP builds (ADAT replies) as the paths. Systems that never use C-Kermit's FTP client can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["ckermit"],"ptokens":["kermit"],"labels":["ckermit","ftpclient","high","linux","package","vendor"],"campaign_type":null,"search_a":"'-129123':16A,19A '-2026':15A,18A 'buffer':6A 'c':2A,21A 'c-kermit':1A,20A 'client':5A 'cve':14A,17A 'ftp':4A 'kermit':3A,22A 'let':8A 'malici':10A 'memori':13A 'overflow':7A 'overwrit':12A 'server':11A","search_b":"'attack':64B 'attacker-control':63B 'buffer':47B 'byte':66B 'c':24B,32B 'c-kermit':23B,31B 'ckcftp.c':51B 'client':28B,36B,60B 'control':65B 'fix':46B 'ftp':27B,35B,56B 'ftp-client':26B 'getrepli':49B 'intercept':55B 'kermit':25B,33B 'linux':29B 'malici':53B 'memori':61B 'mishandl':37B 'overflow':44B 'overlong':38B 'overwrit':59B 'packag':30B 'repli':40B 'secur':39B 'server':43B,57B","search_c":"'11.1.515':72C '4':118C '8.0.200':70C 'adat':113C 'allow':83C 'attack':96C,129C 'attacker-control':128C 'auth':109C 'buf':126C 'buffer':75C 'build':121C 'byte':131C 'c':68C 'c-kermit':67C 'ckcftp.c':81C 'client':89C 'contain':73C 'control':97C,130C 'ftp':85C,101C 'getrepli':79C 'gssapi':116C 'intercept':99C 'kerbero':117C 'kermit':69C 'long':105C,112C 'malici':84C 'memori':90C 'overflow':76C,122C 'overlong':93C 'overwrit':88C 'pbsz':106C 'repli':95C,107C,114C,125C 'secur':94C 'send':92C,104C 'server':86C,102C 'srp':120C 'static':124C 'tls':110C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:36:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129123","severity":null,"published_at":"2026-11-13T17:17:29+00:00","modified_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":148099,"url":"https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148105,"url":"https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148102,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:36:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148108,"url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}