EUVD-2026-42588
GHSA-34r7-v6pv-xq6v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N and PR:N confirmed by description; AC:H reflects that reliable RCE via return-address overwrite requires bypassing modern OS memory protections such as ASLR and stack canaries.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.
AnalysisAI
Stack buffer overflow in Vinchin Backup & Recovery through 9.0.0.86562 exposes the agentlink_server service to unauthenticated remote exploitation via the ModuleHandShake function. An attacker supplying an oversized _listen_uuid value triggers unsafe strcpy() into a fixed-length stack buffer, overwriting the saved return address and enabling process crash or control flow hijack. No public exploit or active exploitation has been confirmed at time of analysis, though the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is network-reachable without authentication or user interaction.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow): the ModuleHandShake function in the agentlink_server service measures input length with strlen() but then copies the _listen_uuid field into a fixed-size stack buffer using strcpy(), which performs no bounds checking. This is the classic C unsafe string copy pattern enabling saved return-address overwrite. The affected product is identified via CPE cpe:2.3:a:vinchin:backup_&_recovery_9.0:*:*:*:*:*:*:*:*. The agentlink_server is a network-facing service component of the Vinchin Backup & Recovery platform, used in enterprise backup agent communication. Because the overflow target is the saved return address on the stack, successful exploitation can redirect execution to attacker-controlled data, depending on the memory protection posture of the target host.
RemediationAI
No vendor-released patch with a confirmed fixed version number has been identified from the available references at time of analysis. Organizations should consult the VulnCheck advisory (https://www.vulncheck.com/advisories/vinchin-backup-recovery-stack-buffer-overflow-via-modulehandshake) and the code-white.com public vulnerability list (https://code-white.com/public-vulnerability-list/) for updated patch information. As an immediate compensating control, restrict network access to the agentlink_server service port using host-based firewalls or network ACLs, allowing only trusted backup agent IP addresses to reach the service - this eliminates the network-reachable attack surface without affecting internal agent communication. If the agentlink_server is not needed in a given deployment, disabling the service entirely eliminates exposure with no functionality trade-off for non-agent deployments. Do not expose the agentlink_server service to untrusted networks or the public internet until a vendor patch is confirmed and applied.
More in Backup Recovery 9 0
View allSame weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today