Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck
CVE-2026-123203NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens
Medium 6.1
In plain English
A medium-severity stack buffer overflow in NEURON from neuronsimulator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.1%top 96.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| neuronsimulator | NEURON | 0 – through 9.0.2 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
References
- https://github.com/neuronsimulator/nrn/pull/3932 issue-tracking, patch
- https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1 patch
- https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96 technical-description
- VulnCheck Advisory: NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens third-party-advisory