The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \…
Priority LOW 39Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \r and \40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.
Why it matters now
EPSS 0.07574 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kvirc:kvirc:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.4.0:*:*:*:*:*:*:* | 3.4.0 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.4.2:*:*:*:*:*:*:* | 3.4.2 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:3.4.2:rc1:*:*:*:*:*:* | 3.4.2 rc1 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | Kvirc |
| cpe:2.3:a:kvirc:kvirc:4.0.2:*:*:*:*:*:*:* | 4.0.2 | Vulnerable | Kvirc |
- cpe:2.3:a:kvirc:kvirc:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.4.2:*:*:*:*:*:*:* Versions 3.4.2 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:3.4.2:rc1:*:*:*:*:*:* Versions 3.4.2 rc1 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Kvirc
- cpe:2.3:a:kvirc:kvirc:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Kvirc
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2010-2785
- 2026-10-03 Alias added: GHSA-f56f-xchc-vpm3
References
Patch 4
- https://svn.kvirc.de/kvirc/changeset/4693
- [oss-security] 20100729 Re: CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter
- [oss-security] 20100728 CVE Request -- KVIrc -- Remote CTCP commands execution via specially-crafted CTCP parameter
- https://svn.kvirc.de/kvirc/ticket/858
More Kvirc vulnerabilities
- TI-2010-02354 Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have… CVSS 2.0HIGH 10.0
- TI-2008-06758 Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote… CVSS 2.0HIGH 9.3
- TI-2010-02355 Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows… CVSS 2.0HIGH 9.3
- TI-2008-04531 Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default… CVSS 2.0HIGH 7.6
Sources
- CVE-2010-2785 · CVE Program
- CVE-2010-2785 · NVD
- FIRST EPSS
- GHSA-f56f-xchc-vpm3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences