---
id: "CVE-2026-114549"
kind: "vulnerability"
aliases: ["CVE-2026-114549"]
title: "NoMachine nxwebrunner web service: heap overflow lets remote attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "NoMachine", "fixed": ["10.1.7", "9.9.6", "8.27.1"], "affected": "unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 per branch", "ecosystem": "vendor"}]
ecosystems: []
tags: ["linux", "nomachine", "other", "remote-desktop", "self-hosted", "windows"]
not_affected_if: ["no-nomachine-installed", "port-4443-blocked"]
published_at: "2026-11-04T00:17:22+00:00"
first_seen_at: "2026-11-04T00:46:15+00:00"
updated_at: "2026-11-04T00:50:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114549", "first_seen_at": "2026-11-04T00:46:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:50:38+00:00"}]
---

# NoMachine nxwebrunner web service: heap overflow lets remote attackers run code

NoMachine's nxwebrunner web service, listening on TCP port 4443 by default, copies user-supplied data into a heap buffer without checking its length. A remote attacker who sends crafted input without logging in can execute code as the service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NoMachine affected unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 per branch fixed 10.1.7, 9.9.6, 8.27.1

## How to check

- Check the installed NoMachine version (About dialog, or nxserver --version on the server) and compare with the fixed releases 10.1.7 / 9.9.6 / 8.27.1
- Check whether the web service is listening on TCP 4443: ss -ltnp | grep 4443 (Linux) or netstat -ano | findstr 4443 (Windows)
- Block 4443 from untrusted networks until patched

## Fix

Upgrade NoMachine to 10.1.7, 9.9.6 or 8.27.1 (or later) on your branch. Per the NoMachine KB TR07X11893 and ZDI-26-786.

## Timeline

- 2026-11-04T00:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114549
- 2026-11-04T00:50:38+00:00 analyst — Vendor KB TR07X11893 and ZDI-26-786 (reported by Sajeeb Lohani, public 2026-10-22) give fixes 10.1.7/9.9.6/8.27.1; vendor does not give affected lower bound or default state beyond ZDI's 'TCP 4443 by default'. No exploitation or PoC found (not searched social). Sibling CVE-2026-92210 same fixed versions. Only fix verified.

## Documents

- [advisory] ZDI-26-786 NoMachine nxwebrunner heap overflow RCE https://www.zerodayinitiative.com/advisories/ZDI-26-786/
- [fix] NoMachine KB: heap buffer overflow in web application (CVE-2026-114549) https://kb.nomachine.com/TR07X11893

## From the sources

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_