EUVD-2026-116037
GHSA-66mf-53rr-w8c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl or peer a linked IRC server
-
ExploitSend JOIN/SJOIN with overlong channel name
-
ExecutionOverflow heap via strcpy/sprintf in ms_join/ms_sjoin
-
ImpactCrash ircd or achieve code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control a server that is linked/peered into the target Solanum network - i.e., the server-to-server trust relationship must already be established; this is not reachable by ordinary unauthenticated IRC clients. Given that peer position, the attacker sends a JOIN or SJOIN message whose channel name exceeds CHANNELLEN, hitting the unbounded strcpy/sprintf paths in ms_join (modules/core/m_join.c) and ms_sjoin and the unvalidated name length in channel.c. The condition is a configured server link plus Solanum built from a commit before 2ce64de; the principal limiting factor is the linked-server (PR:H) prerequisite, which confines the attack to federated deployments and trusted/compromised peers. |
| Impact | The decision signals are internally consistent and point to a serious-but-gated issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.5) requires high privileges, and PR:H here is meaningful: the attacker must already control a linked peer server inside the IRC network's server-to-server trust relationship, not merely hold a client connection. This is a strong limiting factor - ordinary clients cannot reach ms_join/ms_sjoin as a malicious peer. There is no CISA KEV listing and no exploit code among the references (only vendor patch links and the VulnCheck advisory), so exploitation status is 'no public exploit identified at time of analysis'; EPSS was not provided. The vuln.today priority of 'this_week' and VulnCheck sourcing align with a real, patchable memory-corruption flaw that is not under active mass exploitation. One conflict to flag: the input vector sets VA:N (no availability impact) even though the description explicitly says attackers can crash the ircd - availability impact appears understated and should be verified. Net: a genuine priority for anyone running federated Solanum servers, but the PR:H trust precondition sharply narrows the realistic threat population compared to its high base score. |
| Exploit ScenarioDerived | An attacker who operates or compromises a server that is linked (peered) into a Solanum IRC network sends a JOIN or SJOIN message containing a channel name longer than the allowed CHANNELLEN. The overlong name reaches unchecked strcpy/sprintf calls in ms_join and ms_sjoin, overflowing a heap buffer and crashing the ircd or potentially achieving remote code execution. No public exploit code is identified, but the vulnerable code paths are pinpointed in the vendor references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Heap-based memory corruption in the Solanum IRC daemon (builds from before commit 2ce64de) lets a malicious linked server corrupt process memory by sending JOIN or SJOIN messages whose channel names exceed CHANNELLEN, crashing the ircd and potentially yielding remote code execution. The flaw sits on the server-to-server path of a federated network: the attacker must already control a server that is peered into the target Solanum network, so ordinary unauthenticated IRC clients cannot reach it, and the assessed CVSS 3.1 vector (PR:H) reflects that gating. No public exploit identified at time of analysis; the upstream fix is available as a commit and pull request rather than a confirmed tagged release, and the priority signal places it in this_week rather than an emergency tier.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Apply commit 2ce64debf65e9710e9eea099ada93dbf6655b5ff, or merge https://github.com/solanum-ircd/solanum/pull/551, then rebuild and restart the ircd; the patch adds EmptyString and CHANNELLEN length validation in ircd/channel.c and consolidates the LOC_CHANNELLEN check in check_channel_name_loc, so no configuration change is needed once the code is in place. Because the input data does not identify a tagged release containing the fix, verify the deployed commit hash after rebuilding rather than assuming a version number implies the fix. Until the rebuild is scheduled, the practical containment follows from the assessed precondition: the overflow is only reachable over an established server link, so audit link and connect blocks and restrict peering to servers and operators you actually trust, and treat any compromised or decommissioned peer server as a direct path to this overflow. That restriction bounds exposure to federated-trust abuse; it does not repair the unchecked strcpy and sprintf paths, so it is a stopgap, not a substitute for the commit.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Solanum is an IRC daemon that federates with other servers over the server-to-server protocol, exchanging channel state through JOIN and SJOIN messages. Channel names are bounded by CHANNELLEN, but the flawed code paths in modules/core/m_join.c (ms_join, ms_sjoin, and the check_channel_name_loc helper) and in ircd/channel.c around lines 371-385 failed to enforce that bound before passing the attacker-supplied name into unbounded strcpy and sprintf operations that write into heap-allocated buffers, the classic CWE-122 heap-based buffer overflow pattern. The upstream patch (PR #551, commit 2ce64debf65e9710e9eea099ada93dbf6655b5ff) hardens this by rejecting empty names and names longer than CHANNELLEN in channel.c, moving the LOC_CHANNELLEN length check into check_channel_name_loc so it applies uniformly, and dropping the now-redundant inline length test in m_join. Note that the published CVSS 4.0 vector records availability impact as none while the assessed CVSS 3.1 vector records high confidentiality, integrity and availability impact; both agree on network reachability with a high-privilege (linked-server) prerequisite. The trigger is specifically a malformed channel name delivered inside a JOIN or SJOIN from a peer server; how far past CHANNELLEN the name must extend to reach a controllable overwrite is not described in the available sources.
Know when Solanum gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Attacker must control a linked peer server (PR:H) but reaches the flaw over the network with a simple overlong name (AV:N/AC:L); heap overflow enables crash and potential RCE, so C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.
Executive ViewAI
A high-severity memory corruption flaw in the Solanum IRC daemon affects federated networks where malicious servers can send malformed channel names to crash or potentially compromise the IRC server, though exploitation requires control of an already-peered server. Leadership should prioritize patching because a compromised IRC server could disrupt communications and expose the broader network to lateral movement, but the risk is currently contained to environments with untrusted server peering.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB