CVE-2026-123203

MEDIUM 6.1

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

CWE	CWE-121
Vendor	neuronsimulator
Product	neuron
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for neuronsimulator neuron

Be the first to know when new medium vulnerabilities affecting neuronsimulator neuron are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

neuronsimulator / NEURON

0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/neuronsimulator/nrn/pull/3932 github.com: https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1 github.com: https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96 vulncheck.com: https://www.vulncheck.com/advisories/neuron-through-9.0.2-stack-based-buffer-overflow-via-coreneuron-dataset-tokens

Credits

Deus Rex Michael Hines (nrnhines)