CVE-2026-123203

    Dashboard / Vulnerabilities / CVE-2026-123203

    CVE-2026-123203

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens

    Details: NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123203.json, https://nvd.nist.gov/vuln/detail/CVE-2026-123203, https://www.vulncheck.com/advisories/neuron-through-9.0.2-stack-based-buffer-overflow-via-coreneuron-dataset-tokens, https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1, https://github.com/neuronsimulator/nrn/pull/3932, https://github.com/neuronsimulator/nrn, https://github.com/neuronsimulator/nrn/blob/ba5783378c0aa1d9ac95b4454bea94b15c63f75d/src/coreneuron/io/mk_mech.cpp#L81-L96

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6e5a6578a3503c44ee0f19593e7ffb19812ef0e1

    Affected versions

    9.1.0.dev0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123203 | CVE-DB