CVE-2026-129122
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.
References
- https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckctel.c#L5622
- https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f
- https://github.com/OpenKermit/ckermit/commit/42cf6decb926f56d606a76262791aaf071955d25
- https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
- https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p