Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121602Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN

Medium 6.5

In plain English

A medium-severity heap buffer overflow in solanum from solanum-ircd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.

Affected products (as reported)

Vendor	Product	Versions
solanum-ircd	solanum	0 – before 2ce64debf65e9710e9eea099ada93dbf6655b5ff

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/solanum-ircd/solanum/pull/551 issue-tracking, patch
https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff patch
https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507 technical-description
https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385 technical-description
https://github.com/solanum-ircd/solanum product
VulnCheck Advisory: Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN third-party-advisory