Description

VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T19:17:18.953Z",
  "pubdate": "2026-11-05T19:17:18.953Z",
  "executiveSummary": "VRPN (Virtual Reality Peripheral Network) versions through 07.36 are susceptible to an out-of-bounds (OOB) stack write vulnerability within its message handling routines.\nThis vulnerability exists in the vrpn_Endpoint class, specifically affecting how the library processes SENDER_DESCRIPTION and TYPE_DESCRIPTION messages.\nAn unauthenticated, remote attacker can exploit this flaw by supplying a crafted index—specifically an out-of-range or negative value—within the payload of these description messages.\nThe primary risk associated with this vulnerability is a process crash, leading to a denial-of-service (DoS) condition.\nBecause the vulnerability involves an unchecked index leading to an out-of-bounds stack write, there is potential for memory corruption which, depending on the compiler's protection mechanisms and the attacker's ability to control input, could lead to arbitrary code execution (ACE).\nExploitation requires the attacker to establish a network connection with the target and successfully perform the initial version-cookie exchange before sending the malicious message. The vulnerability is exploitable over the network without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation of index parameters provided in network messages handled by the vrpn_Endpoint component. Specifically, the functions vrpn_Endpoint::handle_sender_message() and vrpn_Endpoint::handle_type_message() process incoming descriptions from remote peers without verifying that the index fields provided in the network packet correspond to valid, allocated positions within the internal stack-based buffers.\nIn the VRPN protocol, after the initial handshake, the endpoint expects descriptive messages (SENDER_DESCRIPTION or TYPE_DESCRIPTION) to populate internal lookup tables. The code uses an index supplied by the peer to determine the destination slot for the incoming data. Because these indices are not checked for boundary conditions, an attacker can supply an integer value that is either larger than the buffer size or negative.\nThe attack flow proceeds as follows: First, the attacker initiates a standard TCP or UDP connection to the VRPN server. Second, the attacker must complete the version-cookie exchange process to progress to the state where message descriptions are accepted. Third, the attacker sends a maliciously crafted SENDER_DESCRIPTION or TYPE_DESCRIPTION packet. This packet contains a crafted index value that bypasses expected bounds.\nWhen vrpn_Endpoint::handle_sender_message() or vrpn_Endpoint::handle_type_message() receives this packet, it uses the unchecked index to perform a write operation onto the stack. If the index is negative, it results in an OOB write to memory addresses preceding the buffer; if the index is large, it writes past the buffer's allocated size. This out-of-bounds operation overwrites adjacent stack data, including function return addresses or local variables, which immediately results in a stack corruption event leading to a process crash.\nThe vulnerable functions are part of the core communication logic in VRPN, exposing all installations of version 07.36 and earlier that permit network-accessible communication. Since the vulnerability is triggered during the message parsing phase, an attacker does not require existing sessions or credentials, making it a critical concern for exposed VRPN services. The ability to manipulate the stack pointer or return addresses via this OOB write path characterizes this as a high-severity memory safety issue."
}