CVE-2009-20007

published 2025-09-16

CVE-2009-20007: Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An…

Priority P2 71 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code execution in the context of the vulnerable process. This vulnerability is exploitable remotely and does not require authentication.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
talkative	talkative_irc	<= 0.4.4.16	—

Detection & IOCs extracted from sources · hover to see the quote

version Talkative IRC v0.4.4.16↗

• → Monitor for exploitation of Talkative IRC v0.4.4.16 via overly long response strings sent to a connected client, indicative of a stack-based buffer overflow attempt. ↗
• → A Metasploit module exists for this vulnerability; detect exploitation attempts by monitoring for the module's characteristic crafted response strings targeting Talkative IRC clients. ↗
• → This vulnerability is remotely exploitable without authentication; alert on unexpected or anomalously large IRC response strings received by Talkative IRC client processes. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121