CVE-2026-60095

Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake

Published Jul 9, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.

Analysis

Technical impact

The vulnerability is a stack buffer overflow (CWE-121) in the ModuleHandShake function of the agentlink_server service in Vinchin Backup & Recovery. The function copies the _listen_uuid field into a fixed-size stack buffer using strcpy without validating its length, allowing an attacker to supply an oversized value measured by strlen(). Overwriting the return address can cause the process to crash or, if the attacker controls the overwritten data, hijack execution flow, providing an avenue for code execution. The flaw can be triggered by unauthenticated remote clients that connect to the service.

Affected Systems

This flaw affects installations of Vinchin Backup & Recovery version 9.0 up to 9.0.0.86562, specifically the agentlink_server component.

Risk and Exploitability

The CVSS score is 6.9, indicating a medium severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and vulnerability is not listed in CISA KEV. It can be triggered remotely by sending a crafted ModuleHandShake request over the network to the agentlink_server service; no authentication or special privileges are required. Successful exploitation may lead to a crash or potential remote code execution if the attacker can influence the overwritten control data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Vinchin

Backup & Recovery 9.0

affected

Version	Status	Constraints
`0`	affected	≤ 9.0.0.86562

No data.

Vendor Product Versions

Vinchin

Backup & Recovery

Version	Status	Scheme	Platform
`[0,9.0.0.86562]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Obtain and install the vendor‑supplied patch that corrects the buffer overflow in the agentlink_server ModuleHandShake function; if no patch is available for the affected build, upgrade to a newer 9.0 release that includes the fix or contact Vinchin support for guidance.
Restrict network exposure of the agentlink_server service by limiting connections to trusted hosts or through a VPN, thereby reducing the attack surface for unauthenticated clients.
Enable logging and alerting for anomalous ModuleHandShake requests, focusing on oversized _listen_uuid payloads that may indicate an attempted exploit.

Generated by OpenCVE AI on August 3, 2026 at 04:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.745% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://code-white.com/public-vulnerability-list/
https://www.vinchin.com/news/vinchin-backup-recovery-9-0.html
https://www.vulncheck.com/advisories/vinchin-backup-recovery-stack-buffer-overflow-via-modulehandshake

History

Aug 14, 2026 5:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vinchin vinchin Backup And Recovery
CPEs		cpe:2.3:a:vinchin:vinchin_backup_and_recovery::::::::
Vendors & Products		Vinchin vinchin Backup And Recovery

Jul 10, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vinchin Vinchin backup & Recovery
Vendors & Products		Vinchin Vinchin backup & Recovery

Jul 9, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 9, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.
Title		Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake
Weaknesses		CWE-121
References		https://code-white.com/public-vulnerability-list/ https://www.vinchin.com/news/vinchin-backup-recovery-9-0.html https://www.vulncheck.com/advisories/vinchin-backup-recovery-stack-buffer-overflow-via-modulehandshake
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}`