CVE-2026-129126

Name of the Vulnerable Software and Affected Versions C-Kermit versions prior to 11.1.515

Description A heap buffer overflow exists in the putsrv() function within the ckcfns.c file. This issue occurs when the software processes crafted packets, allowing malicious peers to write data beyond the srvcmd buffer. Specifically, attackers can leverage Kermit repeat-count compression in server command, GET, or file-header packets to write arbitrary bytes beyond the heap buffer on servers or receiving instances.

Recommendations Update C-Kermit to version 11.1.515 or later.