CVE-2026-123203 · Package
NO FIX YET
NEURON (CoreNEURON) through 9.0.2 has a stack buffer overflow when it loads over-long tokens from crafted model dataset files such as bbcore_mech.dat, globals.dat, or files.dat. An attacker who supplies such a dataset can corrupt stack memory and crash the nrniv-core process.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running NEURON or CoreNEURON (nrniv-core) that load model datasets, especially ones from outside sources, are exposed. Teams that only run their own trusted models or do not use CoreNEURON can likely skip it. The sources do not give the fixed version beyond a linked patch.
Not affected if trusted-models-only
Who cares coreneuron, neuron, nrniv-core, scientific-computing
nrniv-core that come from untrusted sources.No fix yet, per the sources.
NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.