Quozl CVEs and Security Vulnerabilities

CVE-2026-121968

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quozl

Products

Netrek-client-cow

CVE-2026-121969

netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage

netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.