CVE-2026-123200— VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

Quick assessment

Affected

VRPN VRPN

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VRPN 07.36 及更早版本在和函数中存在一个越界栈写入漏洞。该漏洞源于对长度索引的未检查操作，允许未经认证的远程对等方在栈缓冲区之外进行写入。攻击者可建立连接、完成版本 - -cookie 交换，随后发送包含越界或负数索引的或消息，从而触发进程崩溃。

CVSS 7.5 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
VRPN	VRPN	`≤ 07.36`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

Source: CVE Program / CVE List V5

Vulnerability Description

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对数组索引的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
VRPN	VRPN	0 ~ 07.36	-

II. Public POCs for CVE-2026-123200

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123200

请登录查看更多情报信息。

Other References for CVE-2026-123200 (5)

https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482 technical-description
https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782 patch
https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2 patch
https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554 technical-description
https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123200

IV. Related Vulnerabilities

Same weakness: CWE-129