CVE-2026-60095 is a stack buffer overflow vulnerability in Vinchin Backup & Recovery through version 9.0.0.86562. The flaw exists in the ModuleHandShake function of the agentlink_server service, where an oversized _listen_uuid field is measured using strlen() and copied into a fixed-length stack buffer using strcpy() without bounds checking. This allows unauthenticated remote attackers to overwrite the saved return address on the stack by sending a crafted request, leading to potential process crashes or control flow hijacking. The vulnerability does not require authentication and has a CVSS 4.0 base score of 6.9 (medium severity). There is no vendor advisory or patch information available at this time.

An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service via process crash or potentially execute arbitrary code by hijacking control flow. This impacts the availability and integrity of the Vinchin Backup & Recovery service. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the agentlink_server service to trusted sources to reduce exposure.