{"id":"CVE-2026-123203","kind":"vulnerability","aliases":["CVE-2026-123203"],"related":[],"title":"NEURON CoreNEURON: stack overflow from crafted model files crashes the process","description":"NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.","summary":"NEURON (CoreNEURON) through 9.0.2 has a stack buffer overflow when it loads over-long tokens from crafted model dataset files such as bbcore_mech.dat, globals.dat, or files.dat. An attacker who supplies such a dataset can corrupt stack memory and crash the nrniv-core process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coreneuron","neuron","nrniv-core","package","scientific-computing"],"not_affected_if":["trusted-models-only"],"how_to_check":"- Check the installed NEURON or CoreNEURON version against the product range (through 9.0.2 is affected).\n- Look for model datasets loaded by `nrniv-core` that come from untrusted sources.","fix":null,"status":"open","published_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:43:12+00:00","updated_at":"2026-11-05T19:43:12+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-05T19:43:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NEURON CoreNEURON: stack overflow from crafted model files crashes the process","impact":"low","summary":"NEURON (CoreNEURON) through 9.0.2 has a stack buffer overflow when it loads over-long tokens from crafted model dataset files such as bbcore_mech.dat, globals.dat, or files.dat. An attacker who supplies such a dataset can corrupt stack memory and crash the nrniv-core process.","audience":"developers","category":"package","nicknames":[],"who_cares":["neuron","coreneuron","nrniv-core","scientific-computing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Process crashes; stack memory corruption from crafted model files","analyst_note":"Confirm the fixed version from the linked patch on github.com and the vulncheck advisory; the sources here do not state it.","how_to_check":"- Check the installed NEURON or CoreNEURON version against the product range (through 9.0.2 is affected).\n- Look for model datasets loaded by `nrniv-core` that come from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-models-only"],"who_is_affected":"Teams running NEURON or CoreNEURON (nrniv-core) that load model datasets, especially ones from outside sources, are exposed. Teams that only run their own trusted models or do not use CoreNEURON can likely skip it. The sources do not give the fixed version beyond a linked patch.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4302,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123203':14A,17A '-2026':13A,16A '9.0.2':30B,75C 'allow':83C 'attack':55B,84C,100C 'bbcore_mech.dat':50B,111C 'buffer':34B,79C 'comput':26B 'contain':76C 'core':22B,70B,119C 'coreneuron':2A,18B,28B,73C 'corrupt':62B,86C 'craft':6A,44B,97C 'crash':9A,66B,121C 'cve':12A,15A 'dataset':46B,60B,99C 'file':8A,47B 'files.dat':53B,114C 'globals.dat':51B,112C 'load':38B,115C 'long':41B,93C 'mechan':107C 'mechanism-nam':106C 'memori':64B,88C 'model':7A,45B,98C 'name':108C 'neuron':1A,19B,27B,72C 'nrniv':21B,69B,118C 'nrniv-cor':20B,68B,117C 'over-long':39B,91C 'overflow':4A,35B,80C 'overs':103C 'packag':23B 'place':102C 'process':11A,71B,123C 'scientif':25B 'scientific-comput':24B 'stack':3A,33B,63B,78C,87C 'suppli':57B,90C 'token':42B,94C,109C 'version':104C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running NEURON or CoreNEURON (nrniv-core) that load model datasets, especially ones from outside sources, are exposed. Teams that only run their own trusted models or do not use CoreNEURON can likely skip it. The sources do not give the fixed version beyond a linked patch.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coreneuron","medium","neuron","nrnivcore","package","scientificcomputing"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123203","severity":null,"published_at":"2026-11-05T19:17:19+00:00","modified_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null}],"documents":[{"id":79200,"url":"https://github.com/neuronsimulator/nrn/commit/6e5a6578a3503c44ee0f19593e7ffb19812ef0e1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79201,"url":"https://www.vulncheck.com/advisories/neuron-through-9.0.2-stack-based-buffer-overflow-via-coreneuron-dataset-tokens","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}