CVE-2026-60095 is a stack buffer overflow vulnerability in Vinchin Backup & Recovery through version 9.0.0.86562. The issue exists in the ModuleHandShake function of the agentlink_server service, where the _listen_uuid field is measured using strlen() and copied into a fixed-length stack buffer using strcpy() without bounds checking. This allows unauthenticated remote attackers to overwrite the saved return address on the stack by supplying an oversized _listen_uuid value, potentially causing a process crash or enabling control flow hijacking.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service by crashing the process or potentially execute arbitrary code by hijacking control flow. This could lead to compromise of the affected system running the vulnerable Vinchin Backup & Recovery agentlink_server service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the agentlink_server service to trusted sources only to reduce exposure to unauthenticated remote attacks.