CVE-2026-60094 describes a heap buffer overflow vulnerability in Vinchin Backup & Recovery versions through 9.0.0.86562. The issue arises because the agentlink_server service does not properly validate the body_len field in incoming TCP packets. An attacker can send a malformed packet with an attacker-controlled length parameter directly to the recv() function, triggering a heap overflow of up to approximately 4 GiB. This can cause the process to crash or result in memory corruption. The vulnerability is exploitable remotely without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and availability impact.

Successful exploitation can cause the agentlink_server process to crash or experience memory corruption, potentially leading to denial of service or instability in the Vinchin Backup & Recovery service. The vulnerability does not require authentication and can be triggered remotely, increasing its risk. However, no known exploits have been reported in the wild, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the agentlink_server service to trusted sources only to reduce exposure. Monitor vendor communications for updates regarding patches or mitigations.