CVE-2026-60095 PUBLISHED

Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake

Assigner: VulnCheck
Reserved: 08.07.2026 Published: 09.07.2026 Updated: 09.07.2026

Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Vinchin
Product Backup & Recovery 9.0
Versions Default: affected
  • affected from 0 to 9.0.0.86562 (incl.)

Credits

  • CODE WHITE GmbH finder

References

Problem Types

  • Stack-based Buffer Overflow CWE