Vulnerabilities

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite…

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

OpenKermit

Product

C-Kermit

CVSS v3.1

8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness

CWE-120

Exposure class

Identity

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-129123 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 18
   CVE NVD 1h ago

   C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files…

   CVSS 6.5 CVE-2026-129121 OpenKermit