{"id":"CVE-2026-114549","kind":"vulnerability","aliases":["CVE-2026-114549"],"related":[],"title":"NoMachine nxwebrunner web service: heap overflow lets remote attackers run code","description":"NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.","summary":"NoMachine's nxwebrunner web service, listening on TCP port 4443 by default, copies user-supplied data into a heap buffer without checking its length. A remote attacker who sends crafted input without logging in can execute code as the service account.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NoMachine","fixed":["10.1.7","9.9.6","8.27.1"],"affected":"unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 per branch","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","nomachine","other","remote-desktop","self-hosted","windows"],"not_affected_if":["no-nomachine-installed","port-4443-blocked"],"how_to_check":"- Check the installed NoMachine version (About dialog, or nxserver --version on the server) and compare with the fixed releases 10.1.7 / 9.9.6 / 8.27.1\n- Check whether the web service is listening on TCP 4443: ss -ltnp | grep 4443 (Linux) or netstat -ano | findstr 4443 (Windows)\n- Block 4443 from untrusted networks until patched","fix":"Upgrade NoMachine to 10.1.7, 9.9.6 or 8.27.1 (or later) on your branch. Per the NoMachine KB TR07X11893 and ZDI-26-786.","status":"open","published_at":"2026-11-04T00:17:22+00:00","first_seen_at":"2026-11-04T00:46:15+00:00","triaged_at":"2026-11-04T00:47:38+00:00","updated_at":"2026-11-04T00:50:38+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-04T00:47:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NoMachine nxwebrunner web service: heap overflow lets remote attackers run code","impact":"high","summary":"NoMachine's nxwebrunner web service, listening on TCP port 4443 by default, copies user-supplied data into a heap buffer without checking its length. A remote attacker who sends crafted input without logging in can execute code as the service account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nomachine","remote-desktop","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs as the NoMachine service account, remotely and unauthenticated","analyst_note":"Find the affected and fixed NoMachine versions and whether nxwebrunner is enabled by default; the NVD entry and the ZDI advisory (ZDI-CAN-30685) are the places to check.","how_to_check":"- Check whether the nxwebrunner web service is running and listening on TCP port 4443, for example with `ss -ltnp | grep 4443` on Linux\n- Confirm the installed NoMachine version against the fixed version, which the sources do not state: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-nomachine-installed","port-4443-blocked"],"who_is_affected":"Any system running NoMachine with the nxwebrunner web service reachable on TCP port 4443 is potentially exposed, since the flaw needs no login. The sources do not say which NoMachine versions are affected or whether the service is on by default in every install, so the exposed version range is unknown. Teams that do not run NoMachine, or that block port 4443 from untrusted networks, can likely deprioritise it, though this is not confirmed by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4227,"output_tokens":647,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed NoMachine versions and whether nxwebrunner is enabled by default; the NVD entry and the ZDI advisory (ZDI-CAN-30685) are the places to check.","search":"'-114549':14A,17A '-2026':13A,16A '30685':167C '4443':38B,117C 'account':70B,162C 'affect':92C 'allow':84C 'arbitrari':89C 'attack':9A,56B,86C,148C 'authent':96C 'base':75C,145C 'buffer':49B,76C,146C 'check':51B 'code':11A,66B,79C,90C,155C 'context':158C 'copi':41B,139C 'craft':59B 'cve':12A,15A 'data':45B,136C 'default':40B,119C 'desktop':24B 'execut':65B,80C,88C,154C 'exist':107C 'exploit':101C 'flaw':106C 'heap':5A,48B,74C,144C 'heap-bas':73C,143C 'host':27B 'input':60B 'instal':93C 'issu':121C 'lack':125C 'length':53B,131C 'let':7A 'leverag':150C 'linux':19B 'listen':34B,113C 'log':62B 'nomachin':1A,20B,29B,71C,95C 'nomachine':18A 'nxwebrunn':2A,31B,72C 'overflow':6A,77C 'port':37B,116C 'prior':137C 'proper':127C 'remot':8A,23B,55B,78C,85C 'remote-desktop':22B 'requir':99C 'result':122C 'run':10A 'self':26B 'self-host':25B 'send':58B 'servic':4A,33B,69B,111C,161C 'specif':105C 'suppli':44B,135C 'tcp':36B,115C 'user':43B,134C 'user-suppli':42B,133C 'valid':128C 'vulner':81C,83C,103C,152C 'web':3A,32B,110C 'window':28B 'within':108C 'without':50B,61B 'zdi':165C 'zdi-can':164C","nicknames":[],"mitigations":[],"who_affected":"Hosts running NoMachine older than the fixed releases 10.1.7, 9.9.6 or 8.27.1 (per branch) with the web service (nxwebrunner) reachable. ZDI says it listens on TCP 4443 by default and needs no login, so anyone who can reach the port can attempt code execution as the service account. Lower affected versions are not stated by the vendor. Hosts without NoMachine, or with 4443 blocked from untrusted networks, can deprioritise it.","tier":"B","verified":{"fix":{"at":"2026-11-04T00:50:38Z","by":"analyst","doc":"https://www.zerodayinitiative.com/advisories/ZDI-26-786/","run_id":1597}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nomachine"],"ptokens":["nomachine"],"labels":["critical","linux","nomachine","other","remotedesktop","selfhosted","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114549","severity":null,"published_at":"2026-11-04T00:17:22+00:00","modified_at":"2026-11-04T00:17:22+00:00","first_seen_at":"2026-11-04T00:46:15+00:00","fetched_at":"2026-11-04T00:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114549:1597","url":null,"severity":null,"published_at":"2026-11-04T00:50:38+00:00","modified_at":"2026-11-04T00:50:38+00:00","first_seen_at":"2026-11-04T00:50:38+00:00","fetched_at":"2026-11-04T00:50:38+00:00","note":"Vendor KB TR07X11893 and ZDI-26-786 (reported by Sajeeb Lohani, public 2026-10-22) give fixes 10.1.7/9.9.6/8.27.1; vendor does not give affected lower bound or default state beyond ZDI's 'TCP 4443 by default'. No exploitation or PoC found (not searched social). Sibling CVE-2026-92210 same fixed versions. Only fix verified."}],"documents":[{"id":62162,"url":"https://kb.nomachine.com/TR07X11893","title":"NoMachine KB: heap buffer overflow in web application (CVE-2026-114549)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":62163,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-786/","title":"ZDI-26-786 NoMachine nxwebrunner heap overflow RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}