CVE Alert: CVE-2026-129126 – OpenKermit – C

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.

**Risk verdict:** This is a potentially severe remote compromise risk for exposed services, but exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** Successful exploitation could affect the confidentiality, integrity and availability of the host running the service, enabling data theft, tampering or disruption. The packet-decoding flaw is especially relevant where the service accepts untrusted peer traffic; evidence of active exploitation is unknown.

**Most likely attack path:** An unauthenticated remote peer sends crafted Kermit packets, with no user action required. The CVSS 4.0 assessment indicates low complexity but a required attack condition is present; its nature is not specified, and the older assessment rates exploitation complexity as high. The stated scope is unchanged, so downstream impact is not established, though host-level compromise could provide a foothold for further activity.

**Who is most exposed:** Prioritise internet-reachable or partner-accessible file-transfer hosts, particularly those operating in server or receiving roles. Internal services are also exposed to untrusted network peers.

Alert on malformed or unusually large Kermit server-command, GET or file-header packets, especially repeat-count patterns.

Review service crashes, restarts and heap-corruption diagnostics alongside inbound connection logs.

Identify externally reachable instances and correlate anomalous sessions with file-transfer activity.

Mitigation and prioritisation:

Upgrade to the fixed release or later; verify the deployed build after change.

Until patched, restrict inbound access to trusted peers and disable server/receiving functions where feasible.

Test transfer workflows in staging and schedule controlled deployment with rollback.

Obtain current KEV, SSVC, PoC and EPSS intelligence; if KEV is true or EPSS ≥0.5, treat as priority 1.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.