{"id":"CVE-2026-123200","title":"VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index","summary":"VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-129"],"vendor":"VRPN","product":"VRPN","affected":["VRPN <= 07.36"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T18:16:37.053Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123200","references":[{"url":"https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782"},{"url":"https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2"},{"url":"https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554"},{"url":"https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482"},{"url":"https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index","label":"VulnCheck Advisory: VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.456Z","slug":"CVE-2026-123200","body":"## Overview\n\nVRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.\n\n## Affected\n\n- `VRPN <= 07.36`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}