CVE-2026-123203: NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens
NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcoremech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running nrniv-core with CoreNEURON model datasets are exposed when those datasets include bbcore_mech.dat, globals.dat, or files.dat. The affected scope is NEURON through 9.0.2.
What does an attacker need to exploit it?
An attacker needs to cause nrniv-core to load a crafted model dataset containing oversized version or mechanism-name tokens in one of the affected dataset files. The supplied vector indicates local access, requires no privileges, and requires user interaction.
What can be done if updating is not immediately possible?
Do not load untrusted model datasets with nrniv-core. Review bbcore_mech.dat, globals.dat, and files.dat for oversized version or mechanism-name tokens before loading them.