Threats affecting pkg:github/quozl/netrek-client-cow

CVE-2026-121969 is a stack-based buffer overflow vulnerability in netrek-client-cow versions up to 3.3.3. The flaw exists in the handleSMessage() function in short.c, where oversized SP_S_MESSAGE packets can overflow a 100-byte stack buffer. This vulnerability allows a malicious Netrek server or a man-in-the-middle attacker on the plaintext TCP connection to send specially crafted messages that overwrite stack memory, potentially crashing the client.

Netrek-client-cow versions up to 3.3.3 have an out-of-bounds read vulnerability in the short.c handleSMessage() function. This flaw allows malicious Netrek servers or attackers intercepting the TCP connection to send crafted SP_S_MESSAGE packets with an unchecked m_recpt index of 36 or higher. Exploitation can cause the client to read beyond array bounds, leading to a denial of service via client crash.