CVE-2026-60095: Vinchin Backup & Recovery Stack Buffer Overflow (CVSS 6.5)

Technical summary

The ModuleHandShake function in agentlink_server processes the _listen_uuid field using strlen() to measure length, then copies the value into a fixed-length stack buffer via strcpy() without bounds checking. This stack buffer overflow (CWE-121) allows an attacker to overwrite the saved return address on the stack. A crafted request with an oversized _listen_uuid value corrupts the stack frame, enabling denial of service via process crash or, with sufficient effort, control flow hijacking to achieve arbitrary code execution. No authentication is required to send the malicious request.

Business impact

Organizations using Vinchin Backup & Recovery as part of their backup infrastructure face two primary risks: service availability loss if the agentlink_server process crashes due to exploitation, and potential data breach or ransomware deployment if an attacker gains code execution. Backup systems are high-value targets; compromise of backup infrastructure undermines disaster recovery capabilities and organizational resilience. The unauthenticated nature of this vulnerability means the attack surface is network-wide for any host running a vulnerable version.

Affected systems

Vinchin Backup & Recovery through version 9.0.0.86562 is affected. The vulnerability resides in the agentlink_server service component. Organizations should verify their installed version against Vinchin's advisory to determine exposure. Verify against the vendor advisory for the complete list of affected product variants and configurations.

Exploitability

Exploitability is straightforward: the flaw requires only network access and a single crafted packet. No authentication, user interaction, or complex setup is needed. The attack surface includes any network segment with access to agentlink_server. While crashing the service is trivial, achieving reliable code execution through stack overflow requires knowledge of the target memory layout and function prologue. However, the simplicity of triggering the vulnerability and the high value of backup systems mean this should be treated as operationally exploitable in real-world scenarios.

Remediation

Apply the patched version of Vinchin Backup & Recovery provided by the vendor. The vendor should release a fixed version with bounds-checked copying or use of safer string functions. Verify against the vendor advisory for the exact patched version number and upgrade path. Until patching is possible, network segmentation to restrict access to agentlink_server ports and disabling the service if not in active use are interim mitigations.

Patch guidance

Contact Vinchin or consult their security advisory for the patched version that addresses this vulnerability. Test the patch in a non-production environment first, particularly given that this affects backup infrastructure. Schedule patching during a maintenance window to avoid impacting backup operations. Verify the patch resolves the vulnerability by confirming the version reported by agentlink_server matches the vendor's fixed build number. Document the patching completion for compliance and audit purposes.

Detection guidance

Look for network traffic to agentlink_server ports containing abnormally long or binary-heavy payloads in the _listen_uuid field, which would be unusual for legitimate ModuleHandShake requests. Monitor agentlink_server process for unexpected crashes or segmentation faults; a pattern of crashes following specific network traffic is a strong indicator of exploitation attempts. Review system logs for process termination or core dumps from the agentlink_server service. Intrusion detection systems can be tuned to alert on oversized payloads sent to Vinchin service ports.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), the practical risk is elevated due to the unauthenticated, network-accessible nature of the vulnerability and the criticality of backup infrastructure. Backup systems are often targeted by ransomware operators and are essential to organizational recovery. An attacker gaining code execution on backup infrastructure can exfiltrate, encrypt, or delete backups, amplifying the impact of a primary attack. The simplicity of exploitation combined with high-value targeting makes this a near-term priority despite the medium score.

Risk score, explained

CVSS 3.1 assigns a score of 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reflecting network accessibility, low complexity, no privileges required, and impacts to integrity and availability. The 'N' for confidentiality reflects that the buffer overflow does not directly leak data; however, post-exploitation code execution would enable data theft. The 'L' for integrity and availability reflects service disruption and potential system compromise. Organizations managing critical backup infrastructure should weight this higher than the numeric score suggests due to the asymmetric impact of backup compromise on disaster recovery and data protection.

Frequently asked questions