Live › vulnerability › CVE-2026-114549
NoMachine's nxwebrunner web service, listening on TCP port 4443 by default, copies user-supplied data into a heap buffer without checking its length. A remote attacker who sends crafted input without logging in can execute code as the service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Hosts running NoMachine older than the fixed releases 10.1.7, 9.9.6 or 8.27.1 (per branch) with the web service (nxwebrunner) reachable. ZDI says it listens on TCP 4443 by default and needs no login, so anyone who can reach the port can attempt code execution as the service account. Lower affected versions are not stated by the vendor. Hosts without NoMachine, or with 4443 blocked from untrusted networks, can deprioritise it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NoMachine | vendor | unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 per branch | 10.1.7, 9.9.6, 8.27.1 |
10.1.7, 9.9.6 or 8.27.1 (or later) on your branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.
This page as .md · .json · in your agent: get_signal("CVE-2026-114549")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.