Vulnerability · Published Jul 9, 2026 · Assigned by VulnCheck

CVE-2026-60094Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server

Medium 6.5

In plain English

A medium-severity out-of-bounds write in Backup & Recovery 9.0 from Vinchin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.

Affected products (as reported)

Vendor	Product	Versions
Vinchin	Backup & Recovery 9.0	0 – through 9.0.0.86562

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

CODE WHITE Vulnerability List technical-description
Product Webpage product
https://www.vulncheck.com/advisories/vinchin-backup-recovery-heap-buffer-overflow-via-agentlink-server third-party-advisory