CVE-2026-123200

HIGH 7.5

VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.

CWE	CWE-129
Vendor	vrpn
Product	vrpn
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for vrpn vrpn

Be the first to know when new high vulnerabilities affecting vrpn vrpn are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

VRPN / VRPN

0 ≤ 07.36

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782 github.com: https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2 github.com: https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554 github.com: https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482 vulncheck.com: https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index

Credits

Deus Rex Russ Taylor