NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

Advisories

NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

Severity: medium
Date: 11/5/2026
Affecting: NEURON <= 9.0.2
CVE: CVE-2026-123203
CWE: CWE-121 Stack-based Buffer Overflow
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
References: https://github.com/neuronsimulator/nrn/pull/3932
https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1
https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96
Credit: Deus Rex, Michael Hines (nrnhines)
Description: NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo