NEURON (CoreNEURON) through version 9.0.2 is vulnerable to a stack buffer overflow that occurs when attackers supply excessively long version or mechanism-name tokens in dataset files such as bbcore_mech.dat, globals.dat, or files.dat. When these files are loaded by the nrniv-core executable, the oversized tokens overflow a stack buffer, corrupting memory and causing the process to terminate. The primary consequence is a denial of service due to forced crashes, and the vulnerability may potentially enable arbitrary code execution if the attacker can also influence other parts of the stack, although this is not explicitly documented.

The affected product is NEURON, the neural network and simulation environment provided by the neuronsimulator organization. All releases up to and including 9.0.2 are vulnerable. Users operating these versions on any platform that runs the CoreNEURON engine are at risk.

The CVSS score of 6.9 classifies the flaw as moderately severe, reflecting a moderate likelihood of success if the attacker can supply malicious dataset files. The EPSS score is not available, but the lack of a public exploit and absence from the CISA KEV catalog suggest that the immediate exploitation likelihood may be limited. Nevertheless, any environment that accepts user-supplied models or permits modification of the dataset files is vulnerable, and the potential to crash the simulation engine could disrupt research or clinical workflows.