Read the docs
TI-2026-84409 Aliases CVE-2026-121603GHSA-6cq2-4j8w-7hvj

Buffer overflow in Solanum server KILL handler

Priority MEDIUM 40CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Solanum before commit 2ea1382 contains a buffer overflow in the server-to-server KILL handler ms_kill() (CWE-120). A rogue or compromised linked server can send a kill reason longer than the limit, which overflows a static 512-byte buffer. This crashes the ircd and could potentially allow remote code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00764 55th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

The sources list no fixed version for Solanum.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121603
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW
  4. 2026-11-03 Alias added: GHSA-6cq2-4j8w-7hvj
  5. 2026-11-05 Priority changed: LOW → MEDIUM

References

Patch 2

Other 2

  • TI-2026-84408 Heap buffer overflow in Solanum via JOIN and SJOIN messages CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences