CVE-2026-60094 – Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server

CVE ID :CVE-2026-60094

Published : July 9, 2026, 1:25 p.m. | 23 minutes ago

Description :Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.

Severity: 6.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…