CVE-2026-123203— NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

Quick assessment

Affected

neuronsimulator NEURON

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NEURON（CoreNEURON）9.0.2 及更早版本存在堆栈缓冲区溢出漏洞。攻击者可通过在精心构造的模型数据集中提供过长的令牌，从而破坏堆栈内存。具体而言，攻击者可在、或文件中插入尺寸过大的版本令牌或机制名称令牌，这些文件会被加载，进而导致进程崩溃。

CVSS 6.1 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

Vendor	Product	Version Range	Status
neuronsimulator	NEURON	`≤ 9.0.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

Source: CVE Program / CVE List V5

Vulnerability Description

NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

栈缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
neuronsimulator	NEURON	0 ~ 9.0.2	-

II. Public POCs for CVE-2026-123203

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123203

请登录查看更多情报信息。

Other References for CVE-2026-123203 (4)

https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96 technical-description
https://github.com/neuronsimulator/nrn/pull/3932 issue-tracking patch
https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1 patch
https://www.vulncheck.com/advisories/neuron-through-9.0.2-stack-based-buffer-overflow-via-coreneuron-dataset-tokens third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123203

IV. Related Vulnerabilities

Same product: NEURON

Same weakness: CWE-121