Heap Buffer Overflow in C-Kermit Affects OpenKermit Software
CVE-2026-129126

9.2CRITICAL

Key Information:

Vendor

Openkermit

Status
C-kermit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129126?

C-Kermit prior to version 11.1.515 has a significant heap buffer overflow vulnerability located in the putsrv() function within ckcfns.c. This flaw can be exploited by malicious users who send specially crafted packets that surpass the srvcmd buffer limits. By utilizing the Kermit repeat-count compression feature in server command, GET requests, or file-header packets, attackers may manipulate server or receiving instances, writing arbitrary data beyond the designated heap buffer. This could lead to severe security implications, making it crucial for users to upgrade to the latest version to mitigate potential risks.

Affected Version(s)

C-Kermit 0 < 11.1.515

References

https://github.com/OpenKermit/ckermit/security/advisories...
vendor-advisory
https://github.com/OpenKermit/ckermit/commit/37e547207792...
patch
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Goerzen
John Goerzen
.