Out-of-Bounds Stack Write in VRPN Affects Remote Peer Communication

CVE-2026-123200

What is CVE-2026-123200?

VRPN versions up to 07.36 are impacted by an out-of-bounds stack write vulnerability that occurs in the functions vrpn_Endpoint::handle_sender_message() and handle_type_message(). This vulnerability allows unauthenticated remote peers to exploit an unchecked length index, causing them to write outside the stack buffer. If an attacker successfully completes the version-cookie exchange, they can send a malformed SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative length index, resulting in process crashes and potential denial of service.

References