{"id":"CVE-2026-129126","kind":"vulnerability","aliases":["CVE-2026-129126"],"related":[],"title":"C-Kermit: heap overflow in putsrv lets malicious peers write memory","description":"C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.","summary":"C-Kermit before 11.1.515 has a heap buffer overflow in putsrv() in ckcfns.c. A malicious peer sending crafted Kermit packets with repeat-count compression can write attacker-chosen bytes past the srvcmd heap buffer on servers or receiving instances.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"C-Kermit","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c-kermit","file-transfer","kermit","runtime"],"not_affected_if":["c-kermit-11.1.515-or-later"],"how_to_check":"- Check the installed C-Kermit version with `kermit` and confirm whether it is below `11.1.515`.\n- Look for C-Kermit running in server mode or accepting incoming transfers, since the sources say servers and receiving instances are affected.","fix":"- C-Kermit: `11.1.515`","status":"open","published_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:48:39+00:00","updated_at":"2026-11-13T17:48:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T17:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: `11.1.515`","reach":"network","title":"C-Kermit: heap overflow in putsrv lets malicious peers write memory","impact":"high","summary":"C-Kermit before 11.1.515 has a heap buffer overflow in putsrv() in ckcfns.c. A malicious peer sending crafted Kermit packets with repeat-count compression can write attacker-chosen bytes past the srvcmd heap buffer on servers or receiving instances.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["c-kermit","kermit","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote peer writes attacker-chosen bytes to heap memory, possibly running code","analyst_note":"","how_to_check":"- Check the installed C-Kermit version with `kermit` and confirm whether it is below `11.1.515`.\n- Look for C-Kermit running in server mode or accepting incoming transfers, since the sources say servers and receiving instances are affected.","plain_action":"","product_name":"C-Kermit","needs_analyst":false,"not_affected_if":["c-kermit-11.1.515-or-later"],"who_is_affected":"Systems running C-Kermit before 11.1.515 as a server or as a receiver of file transfers are exposed, because the flaw is triggered by crafted Kermit packets from a peer. Clients that only send files to trusted peers and never listen for connections are less exposed, but the sources do not state this distinction explicitly.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000763,"input_tokens":4667,"output_tokens":592,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129126':15A,18A '-2026':14A,17A '11.1.515':34B,76C 'allow':88C 'attack':59B,101C,121C 'attacker-chosen':58B,120C 'beyond':124C 'buffer':38B,66B,80C,96C,127C 'byte':61B,123C 'c':2A,20A,23B,31B,73C 'c-kermit':1A,19A,22B,30B,72C 'chosen':60B,122C 'ckcfns.c':43B,86C 'command':111C 'compress':55B,108C 'contain':77C 'count':54B,107C 'craft':48B,99C 'cve':13A,16A 'file':26B,115C 'file-head':114C 'file-transf':25B 'get':112C 'header':116C 'heap':4A,37B,65B,79C,126C 'instanc':71B,132C 'kermit':3A,21A,24B,28B,32B,49B,74C,104C 'let':8A 'malici':9A,45B,89C 'memori':12A 'overflow':5A,39B,81C 'packet':50B,100C,117C 'past':62B,93C 'peer':10A,46B,90C 'putsrv':7A,41B,84C 'receiv':70B,131C 'repeat':53B,106C 'repeat-count':52B,105C 'runtim':29B 'send':47B,98C 'server':68B,110C,129C 'srvcmd':64B,95C 'transfer':27B 'use':103C 'vulner':82C 'write':11A,57B,92C,119C","nicknames":[],"mitigations":[],"who_affected":"Systems running C-Kermit before 11.1.515 as a server or as a receiver of file transfers are exposed, because the flaw is triggered by crafted Kermit packets from a peer. Clients that only send files to trusted peers and never listen for connections are less exposed, but the sources do not state this distinction explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ckermit"],"ptokens":["kermit"],"labels":["ckermit","critical","filetransfer","kermit","runtime","vendor"],"campaign_type":null,"search_a":"'-129126':15A,18A '-2026':14A,17A 'c':2A,20A 'c-kermit':1A,19A 'cve':13A,16A 'heap':4A 'kermit':3A,21A 'let':8A 'malici':9A 'memori':12A 'overflow':5A 'peer':10A 'putsrv':7A 'write':11A","search_b":"'11.1.515':34B 'attack':59B 'attacker-chosen':58B 'buffer':38B,66B 'byte':61B 'c':23B,31B 'c-kermit':22B,30B 'chosen':60B 'ckcfns.c':43B 'compress':55B 'count':54B 'craft':48B 'file':26B 'file-transf':25B 'heap':37B,65B 'instanc':71B 'kermit':24B,28B,32B,49B 'malici':45B 'overflow':39B 'packet':50B 'past':62B 'peer':46B 'putsrv':41B 'receiv':70B 'repeat':53B 'repeat-count':52B 'runtim':29B 'send':47B 'server':68B 'srvcmd':64B 'transfer':27B 'write':57B","search_c":"'11.1.515':76C 'allow':88C 'attack':101C,121C 'attacker-chosen':120C 'beyond':124C 'buffer':80C,96C,127C 'byte':123C 'c':73C 'c-kermit':72C 'chosen':122C 'ckcfns.c':86C 'command':111C 'compress':108C 'contain':77C 'count':107C 'craft':99C 'file':115C 'file-head':114C 'get':112C 'header':116C 'heap':79C,126C 'instanc':132C 'kermit':74C,104C 'malici':89C 'overflow':81C 'packet':100C,117C 'past':93C 'peer':90C 'putsrv':84C 'receiv':131C 'repeat':106C 'repeat-count':105C 'send':98C 'server':110C,129C 'srvcmd':95C 'use':103C 'vulner':82C 'write':92C,119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:36:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129126","severity":null,"published_at":"2026-11-13T17:17:29+00:00","modified_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148117,"url":"https://github.com/OpenKermit/ckermit/commit/37e54720779237897bc6887efac42fe138817897","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148102,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:36:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148120,"url":"https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-heap-buffer-overflow-via-putsrv-packet-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}