Live › vulnerability › CVE-2026-92208
Go to dashboardNoMachine's server mDNS component copies resource-record data into a heap buffer without checking its length. An unauthenticated attacker on the same network segment can send a crafted mDNS packet and run code as the NoMachine service account (CVSS 8.8, AV:A). The vendor KB calls it a possible denial of service with potential code execution. Reported 2026-08-07, fixed and disclosed 2026-09-16. Not known to be exploited. The only public repo linked to the CVE is a README with no exploit code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| NoMachine | vendor | 9.8.2_1 confirmed; full range unknown, fixed branches listed | 10.1.7, 9.9.6, 8.27.1 |
10.1.7 (10.x), 9.9.6 (9.x) or 8.27.1 (8.x) should be treated as exposed10.1.7, 9.9.6 or 8.27.1, whichever matches your branch (https://kb.nomachine.com/software-updates)8.27.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.
This page as .md · .json · in your agent: get_signal("CVE-2026-92208")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.