CVE-2026-60095: Vinchin Backup & Recovery 9.0

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.

Affected products

• Vinchin Backup & Recovery 9.0: up to and including 9.0.0.86562

Published 2026-07-09. Last modified 2026-07-10.