{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123200", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:49.999Z", "datePublished": "2026-11-05T18:16:37.053Z", "dateUpdated": "2026-11-05T18:16:37.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:37.053Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index", "descriptions": [{"lang": "en", "value": "VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Array Index", "cweId": "CWE-129", "type": "CWE"}]}], "affected": [{"vendor": "VRPN", "product": "VRPN", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "07.36", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/vrpn/vrpn", "repo": "https://github.com/vrpn/vrpn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782", "tags": ["patch"]}, {"url": "https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2", "tags": ["patch"]}, {"url": "https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554", "tags": ["technical-description"]}, {"url": "https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index"}], "credits": [{"lang": "en", "value": "Deus Rex", "type": "finder"}, {"lang": "en", "value": "Russ Taylor", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/vrpn/vrpn", "product": "VRPN", "repo": "https://github.com/vrpn/vrpn", "vendor": "VRPN", "versions": [{"lessThanOrEqual": "07.36", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process."}], "id": "CVE-2026-123200", "lastModified": "2026-11-05T19:17:18.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T19:17:18.953", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "vrpn: vrpn: Denial of Service via out-of-bounds stack write", "id": "2567874", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567874"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in vrpn. An unauthenticated remote attacker can trigger an out-of-bounds write vulnerability by sending specially crafted network messages containing an invalid length index. Successful exploitation leads to memory corruption, causing the application to crash and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123200", "public_date": "2026-11-05T18:16:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123200\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123200\nhttps://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482\nhttps://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554\nhttps://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782\nhttps://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2\nhttps://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger process crashes and service disruption across the network without requiring privileges or user interaction. The vrpn component is not distributed or supported in Red Hat Enterprise Linux or other Red Hat product offerings, meaning default deployments remain unaffected. Where the software is independently deployed, the blast radius is restricted to the terminating service process.", "threat_severity": "Important"}