C-KERMIT · CVE-2026-129126 · Runtime
NO FIX YET · SEE WHAT TO DO
C-Kermit before 11.1.515 has a heap buffer overflow in putsrv() in ckcfns.c. A malicious peer sending crafted Kermit packets with repeat-count compression can write attacker-chosen bytes past the srvcmd heap buffer on servers or receiving instances.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running C-Kermit before 11.1.515 as a server or as a receiver of file transfers are exposed, because the flaw is triggered by crafted Kermit packets from a peer. Clients that only send files to trusted peers and never listen for connections are less exposed, but the sources do not state this distinction explicitly.
Not affected if c-kermit-11.1.515-or-later
Who cares c-kermit, file-transfer, kermit
kermit and confirm whether it is below 11.1.515.11.1.515C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.