CVE-2026-129123
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to ove
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 13, 2026 · Last modified: Nov 13, 2026 · CWE-120
Not enough EPSS history yet.
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.
- github.comhttps://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L11161
- github.comhttps://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f
- github.comhttps://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69
- github.comhttps://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
- github.comhttps://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
- www.vulncheck.comhttps://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies
- github.comhttps://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-0436——
——0Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service.1dCVE-2026-1100887.8 HIG28.6%
——9Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.3dCVE-2026-1100876.7 MED16.4%
——5Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file.3dCVE-2026-1249478.8 HIG26.9%
——8Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.3dCVE-2026-1249268.8 HIG28.4%
——9Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.3dCVE-2026-1249248.8 HIG28.4%
——9Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.3d