CVE-2026-121968

Name of the Vulnerable Software and Affected Versions Netrek-client-cow versions 3.3.3 and earlier

Description An out-of-bounds read occurs in the handleSMessage() function within short.c. This issue allows a malicious server or an attacker intercepting the plaintext TCP connection to cause a client crash by sending SP S MESSAGE packets where the m recpt index is 36 or greater. This results in the system reading beyond the players[] and shipnos arrays, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.