Heap Buffer Overflow in Solanum IRC Server Software
CVE-2026-121602

8.5HIGH

Key Information:

Vendor

Solanum-ircd

Status
Solanum
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121602?

The Solanum IRC server prior to commit 2ce64de is vulnerable to a heap-based buffer overflow, which can be exploited by an attacker controlling a linked server. This occurs when overlong channel names are sent in JOIN or SJOIN messages. The exploitation of this vulnerability may allow attackers to corrupt memory, potentially causing the IRC daemon to crash or enabling the execution of arbitrary code. Proper validation of input lengths is critical to mitigate this risk.

Affected Version(s)

solanum 0 < 2ce64debf65e9710e9eea099ada93dbf6655b5ff

References

https://github.com/solanum-ircd/solanum/pull/551
issue-trackingpatch
https://github.com/solanum-ircd/solanum/commit/2ce64debf6...
patch
https://github.com/solanum-ircd/solanum/blob/2ea1382e4262...
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tristan Madani (Talence Security)
aaronmdjones
.