Solanum IRCd CVE-2026-121603

Exploitation requires the attacker to control a linked peer server in the Solanum IRC network - a rogue server or a compromised legitimate peer that already holds an established, trusted server-to-server link; it is NOT reachable by ordinary clients or by unauthenticated outside attackers. The malicious peer triggers the flaw by sending a KILL message handled by ms_kill() with a reason string whose length exceeds KILLLEN, overflowing a static 512-byte buffer. Limiting factors: server linking in IRC is a privileged, pre-configured trust relationship (link blocks/credentials), so realistic risk is confined to networks that federate with partially-trusted or externally-operated servers; affected builds are those before commit 2ea1382, and updating past that commit removes the flaw by truncating the reason.

This is a genuine but access-gated server-to-server vulnerability, not an internet-facing mass-exploitation risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.5) correctly captures the most important limiter via PR:H: exploitation requires the attacker to control a linked peer in the IRC server mesh, meaning a rogue or already-compromised server that has an established, trusted server-to-server link - not an ordinary client and not an unauthenticated remote attacker. Given that gate, attack complexity is low and the overflow is reliably triggerable by any peer that can emit a KILL. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only confirmed artifacts are the vendor patch (PR #550 / commit 2ea1382). The vuln.today priority is 'this_week' rather than act_now/emergency, which is consistent with a high-impact bug whose exploitation precondition (holding a trusted link) substantially narrows the realistic attacker set. One signal conflict worth noting: the supplied CVSS 4.0 vector sets VA:N (no availability impact) even though the description explicitly states the overflow crashes the ircd - the availability impact appears understated. Net: treat as a priority patch for operators running multi-server IRC networks, especially networks that federate links with partially-trusted or externally-operated servers, but it is not a drop-everything internet-wide emergency.

An attacker who operates a rogue server linked into a Solanum-based IRC network - or who has compromised a legitimately linked peer - sends a KILL command through the server-to-server protocol with a reason string longer than KILLLEN. The oversized reason overflows a static 512-byte buffer in the ms_kill() handler, crashing the target ircd and potentially allowing remote code execution. No public PoC or exploit code is referenced in the available data; only the fixing patch is published.