CVE-2026-60094: Vinchin Backup & Recovery 9.0

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.

Affected products

• Vinchin Backup & Recovery 9.0: up to and including 9.0.0.86562

Published 2026-07-09. Last modified 2026-07-10.