CVE-2026-60094
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vinchin Backup & Recovery through version 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause a process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB, resulting in process crash or potential memory corruption.
Risk Assessment
The risk for the organization includes potential remote code execution or complete service disruption of the backup service, which could lead to data loss and business continuity issues.
Recommendation
It is recommended to immediately update Vinchin Backup & Recovery to the latest available version that fixes this vulnerability and restrict access to the agentlink_server service to trusted networks only.
Other vulnerabilities in Vinchin Backup & Recovery
See all- CVE-2024-22902Critical
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.
- CVE-2024-22901Critical
Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.
- CVE-2026-60095Medium
A stack buffer overflow vulnerability in the agentlink_server service of Vinchin Backup & Recovery through version 9.0.0.86562. An unauthenticated remote attacker can overwrite the saved return address by sending a crafted request with an oversized _listen_uuid field, which is copied without bounds checking into a fixed-length stack buffer using strcpy().
- CVE-2024-22903High
Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the deleteUpdateAPK function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.
- CVE-2024-22900High
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. An attacker with a valid account can send a crafted request to this function, leading to arbitrary code execution on the server.
- CVE-2024-22899High
Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the syncNtpTime function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.
Original NVD description (English source)
Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.