EUVD-2026-42587
GHSA-m3jh-5jc7-f446
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated service with no conditions; process crash is the confirmed primary impact (A:H); memory corruption introduces limited integrity risk (I:L); no confidentiality impact demonstrated.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.
AnalysisAI
Heap buffer overflow in Vinchin Backup & Recovery through version 9.0.0.86562 allows unauthenticated remote attackers to crash the agentlink_server process or corrupt heap memory without any prior access or user interaction. The agentlink_server service accepts a TCP packet body_len field without bounds validation, passing the attacker-controlled value directly to recv() and enabling heap writes of up to approximately 4 GiB beyond the allocated buffer. This vulnerability is not listed in CISA KEV and no public exploit code is confirmed at time of analysis, though the heap overflow magnitude raises concern for potential code execution beyond simple denial-of-service.
Technical ContextAI
The vulnerability resides in the agentlink_server TCP service of Vinchin Backup & Recovery 9.0, identified by CPE cpe:2.3:a:vinchin:backup_&_recovery_9.0:*:*:*:*:*:*:*:*. CWE-787 (Out-of-bounds Write) describes the root cause: the service parses an incoming TCP packet header containing a body_len field and forwards that value without range validation to the POSIX recv() system call as the buffer length parameter. Because body_len is unchecked, an attacker can supply a value approaching the 32-bit unsigned integer maximum (~4 GiB), instructing recv() to write network data far beyond the boundaries of the heap-allocated receive buffer. This is a classic length confusion vulnerability in a custom binary protocol parser - the service trusts the client-supplied length rather than enforcing a maximum, making exploitation trivially reproducible with a single malformed packet.
RemediationAI
No vendor-released patched version has been independently confirmed from the available references - the fix version is not independently verified at time of analysis. Administrators should actively monitor the Vinchin vendor communications at https://www.vinchin.com/news/vinchin-backup-recovery-9-0.html and the VulnCheck advisory at https://www.vulncheck.com/advisories/vinchin-backup-recovery-heap-buffer-overflow-via-agentlink-server for patch or updated build availability. As an immediate and highly effective compensating control, restrict network access to the agentlink_server TCP port using host-based firewall rules or network ACLs, permitting inbound connections only from known and trusted backup client IP addresses - this directly eliminates the unauthenticated remote attack vector without impacting backup operations for authorized clients. If the agentlink_server component is not actively used in the current deployment, disabling or stopping the service eliminates exposure entirely until a patch is released. Note that firewall-based mitigations do not address insider threats or compromised backup clients already in the allowlist.
More in Backup Recovery 9 0
View allSame weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today