---
id: "CVE-2026-129123"
page: "https://infrastack.ai/live/CVE-2026-129123"
kind: "vulnerability"
aliases: ["CVE-2026-129123"]
title: "C-Kermit: FTP client buffer overflow lets a malicious server overwrite memory"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "C-Kermit", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["c-kermit", "ftp-client", "linux", "package"]
not_affected_if: ["no-ftp-client-use", "trusted-servers-only"]
published_at: "2026-11-13T17:17:29+00:00"
first_seen_at: "2026-11-13T17:48:00+00:00"
updated_at: "2026-11-13T17:48:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129123", "first_seen_at": "2026-11-13T17:48:00+00:00"}]
exploit_sources: []
---

# C-Kermit: FTP client buffer overflow lets a malicious server overwrite memory

Link for people: https://infrastack.ai/live/CVE-2026-129123 (this .md is for agents)

C-Kermit's FTP client mishandles overlong security replies from a server, overflowing a fixed buffer in getreply() in ckcftp.c. A malicious or intercepted FTP server can overwrite client memory with attacker-controlled bytes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:C-Kermit affected range not listed fixed no fixed version listed

## How to check

- Run `kermit` and check the version banner for C-Kermit 8.0.200 through 11.1.514.
- Check whether the build uses FTP with AUTH TLS, GSSAPI, Kerberos 4 or SRP support, which the description names as the trigger paths.

## Fix

- C-Kermit: `11.1.515`

## Timeline

- 2026-11-13T17:48:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129123

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies
- [fix] Patch: github.com https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f
- [fix] Patch: github.com https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69
- [fix] Release notes: github.com https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515

## From the sources

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_