The vulnerability is a stack buffer overflow in the ModuleHandShake function of the agentlink_server service in Vinchin Backup & Recovery. The function copies the _listen_uuid field into a fixed-size stack buffer using strcpy without validating its length, allowing an attacker to supply an oversized value measured by strlen(). Overwriting the return address can cause the process to crash or, if the attacker controls the overwritten data, hijack execution flow, providing an avenue for code execution. The flaw can be triggered by unauthenticated remote clients that connect to the service.

This flaw affects installations of Vinchin Backup & Recovery version 9.0 up to 9.0.0.86562, specifically the agentlink_server component.

The CVSS score is 6.9, indicating a medium severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and vulnerability is not listed in CISA KEV. It can be triggered remotely by sending a crafted ModuleHandShake request over the network to the agentlink_server service; no authentication or special privileges are required. Successful exploitation may lead to a crash or potential remote code execution if the attacker can influence the overwritten control data.