PT-2026-56802 · Vinchin · Vinchin Backup & Recovery

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-60095

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery versions prior to 9.0.0.86563

Description A stack buffer overflow exists in the ModuleHandShake() function of the agentlink server service. An unauthenticated remote attacker can exploit this by providing an oversized listen uuid field. The system measures this field using strlen() and copies it into a fixed-length stack buffer via strcpy() without performing bounds checking. This can lead to the overwriting of the saved return address, resulting in a process crash or potential control flow hijack.

Recommendations Update to a version newer than 9.0.0.86562.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-60095

Affected Products

Vinchin Backup & Recovery

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-60095 · Security Note
• https://twitter.com/CVEnew/status/2075229329718460521 · Twitter Post
• https://vulncheck.com/advisories/vinchin-backup-recovery-stack-buffer-overflow-via-modulehandshake · Note
• https://twitter.com/infoflowcloud/status/2075230015067746614 · Twitter Post
• https://code-white.com/public-vulnerability-list · Note
• https://vinchin.com/news/vinchin-backup-recovery-9-0.html · Note