---
id: CVE-2026-123200
title: >-
  VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION
  length index
summary: >-
  VRPN through 07.36 contains an out-of-bounds stack write vulnerability in
  vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows
  unauthenticated remote peers to write outside a stack buffer via an unchecked
  length i…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-129
vendor: VRPN
product: VRPN
affected:
  - VRPN <= 07.36
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T18:16:37.053Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123200'
references:
  - url: >-
      https://github.com/vrpn/vrpn/commit/0da5b0b71e06e8c318a4e674c84caee12251a782
  - url: >-
      https://github.com/vrpn/vrpn/commit/c893b583d928fd17d756b39271b2eae71766e7f2
  - url: >-
      https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4554
  - url: >-
      https://github.com/vrpn/vrpn/blob/79deb000cc0b47ae49a80c92c78167c02d8a04d8/vrpn_Connection.C#L4482
  - url: >-
      https://www.vulncheck.com/advisories/vrpn-through-07.36-out-of-bounds-write-via-sender-description-type-description-length-index
    label: >-
      VulnCheck Advisory: VRPN through 07.36 Out-of-bounds Write via
      SENDER_DESCRIPTION/TYPE_DESCRIPTION length index
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.456Z'
---

## Overview

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.

## Affected

- `VRPN <= 07.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.