{"id":"CVE-2026-129122","aliases":["CVE-2026-129123","CVE-2026-129124","CVE-2026-129125","CVE-2026-129126","GHSA-c5px-7h4c-gj8p"],"url":"https://o3.security/vulnerability/CVE-2026-129122","summary":"C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation","details":"C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.","published":"2026-11-13T16:23:44.625Z","modified":"2026-11-15T07:03:34.201158648Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f","label":"OpenKermit/ckermit@39ab009"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129122.json"},{"type":"ADVISORY","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"type":"ADVISORY","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129122"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-buffer-overflow-via-telnet-new-environ-negotiation"},{"type":"FIX","url":"https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"},{"type":"FIX","url":"https://github.com/OpenKermit/ckermit/commit/42cf6decb926f56d606a76262791aaf071955d25"},{"type":"ARTICLE","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckctel.c#L5622"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-15T07:03:34.201158648Z"}}