CVE-2026-129123

EUVD-2026-125556
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L11161
https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f
https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies
https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p