Description

NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_mech.dat, globals.dat, or files.dat loaded by nrniv-core to crash the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-05T19:17:19.530Z",
  "pubdate": "2026-11-05T19:17:19.530Z",
  "executiveSummary": "NEURON (CoreNEURON) versions up to 9.0.2 are susceptible to a stack-based buffer overflow vulnerability triggered by processing malformed model data.\nThe vulnerability originates from inadequate bounds checking when the nrniv-core component parses tokens within specific input files, specifically bbcore_mech.dat, globals.dat, or files.dat.\nAn attacker capable of providing a crafted model dataset can inject oversized tokens, such as mechanism names or version strings, to overflow the stack buffer during file I/O operations.\nSuccessful exploitation results in memory corruption, which typically leads to an application crash (Denial of Service).\nThis vulnerability requires an attacker to successfully supply the vulnerable software with a malicious input file, making the risk dependent on the source and trust level of the loaded model data.",
  "technicalDetails": "The vulnerability exists within the nrniv-core utility, which is responsible for loading and parsing neurocomputational model datasets. The root cause is a classic stack-based buffer overflow occurring during the ingestion of external configuration files.\nSpecifically, when CoreNEURON processes the bbcore_mech.dat, globals.dat, or files.dat files, it utilizes fixed-size buffers on the stack to store string tokens representing mechanism names, version identifiers, or other configuration parameters. The implementation fails to perform adequate length validation on these tokens before performing memory copy operations (e.g., using unsafe functions like strcpy or sprintf).\nAn attacker can exploit this by crafting a malicious model dataset where the length of a token exceeds the capacity of the allocated destination buffer on the stack. By supplying a token significantly longer than expected, the attacker causes the data to overflow the buffer, overwriting adjacent memory locations on the stack frame. This overwriting process typically corrupts local variables, saved stack pointers, and the function return address.\nThe attack flow proceeds as follows: First, the attacker creates a malicious file (such as bbcore_mech.dat) containing an oversized string in place of a standard configuration token. Second, the attacker invokes the nrniv-core process, pointing it to the directory or path containing the corrupted dataset. Third, as the application attempts to parse the maliciously crafted file, the input routine fails to limit the copied data to the buffer size, triggering the overflow.\nThe immediate impact of this memory corruption is a segmentation fault or a similar memory access violation, leading to an immediate process crash and termination, thus resulting in a Denial of Service (DoS) for the CoreNEURON application. While the primary impact observed is a crash, stack-based overflows generally carry the theoretical risk of arbitrary code execution if an attacker can precisely control the overwritten return address and redirect the execution flow to injected shellcode or existing executable memory regions (ROP chains), although such exploitability is highly dependent on system-level protections like ASLR and stack canaries.\nThe vulnerability affects all versions of CoreNEURON up to and including 9.0.2, and it does not require authentication to trigger if the attacker can influence the environment where the simulation datasets are processed."
}