Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121968Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Medium 6.5

In plain English

A medium-severity security flaw in netrek-client-cow from quozl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	netrek-client-cow	no fix listed	UBUNTU-CVE-2026-121968
Ubuntu:24.04:LTS	netrek-client-cow	no fix listed	UBUNTU-CVE-2026-121968
Ubuntu:26.04:LTS	netrek-client-cow	no fix listed	UBUNTU-CVE-2026-121968
Ubuntu:26.10	netrek-client-cow	no fix listed	UBUNTU-CVE-2026-121968

Affected products (as reported)

Vendor	Product	Versions
quozl	netrek-client-cow	0 – through 3.3.3

Weakness: CWE-129 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Patch Commit patch
https://github.com/quozl/netrek-client-cow product
https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L942-L943 technical-description
VulnCheck Advisory: Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets third-party-advisory