{"id":"CVE-2026-92208","kind":"vulnerability","aliases":["CVE-2026-92208"],"related":[],"title":"NoMachine: mDNS parser heap overflow lets network attackers run code","description":"NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.","summary":"NoMachine's server mDNS component copies resource-record data into a heap buffer without checking its length. An unauthenticated attacker on the same network segment can send a crafted mDNS packet and run code as the NoMachine service account (CVSS 8.8, AV:A). The vendor KB calls it a possible denial of service with potential code execution. Reported 2026-08-07, fixed and disclosed 2026-09-16. Not known to be exploited. The only public repo linked to the CVE is a README with no exploit code.","severity":"high","cvss":8.8,"epss":0.00584,"exploited":false,"exploited_at":null,"products":[{"name":"NoMachine","fixed":["10.1.7","9.9.6","8.27.1"],"affected":"9.8.2_1 confirmed; full range unknown, fixed branches listed","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["lan","linux","macos","mdns","nomachine","other","self-hosted","windows"],"not_affected_if":["patched-version","unknown"],"how_to_check":"Check the installed NoMachine version in the NoMachine client or tray, under About, or in the server's installed package. Anything below 10.1.7 (10.x), 9.9.6 (9.x) or 8.27.1 (8.x) should be treated as exposed. Whether mDNS discovery must be enabled for the bug to be reachable is not stated in the sources.","fix":"Update NoMachine to 10.1.7, 9.9.6 or 8.27.1, whichever matches your branch (https://kb.nomachine.com/software-updates). The vendor KB writes the 8.x fix as 8.27 and ZDI writes 8.27.1. Until you have patched, keep NoMachine hosts off shared or untrusted LAN segments.","status":"open","published_at":"2026-10-21T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:59+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:32:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NoMachine: mDNS parser heap overflow lets network attackers run code","impact":"high","summary":"NoMachine's mDNS resource record parser copies attacker-supplied data into a heap buffer without checking its length. A network-adjacent attacker who sends crafted mDNS traffic can run code as the NoMachine service account.","category":"other","who_cares":["nomachine","windows","macos","linux","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Code runs as the NoMachine service account on the host.","analyst_note":"Find the affected and fixed NoMachine versions and whether mDNS discovery must be enabled, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-92208 and the ZDI advisory it cites (ZDI-CAN-30982).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":3024,"output_tokens":378,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed NoMachine versions and whether mDNS discovery must be enabled, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-92208 and the ZDI advisory it cites (ZDI-CAN-30982).","search":"'-07':89B '-08':88B '-09':94B '-16':95B '-2026':12A,15A '-92208':13A,16A '2026':87B,93B '30982':209C '8.8':69B 'account':67B,204C 'adjac':132C 'affect':139C 'allow':129C 'arbitrari':136C 'attack':8A,48B,133C,190C 'authent':143C 'av':70B 'base':120C,187C 'buffer':41B,121C,188C 'call':75B 'check':43B 'code':10A,62B,84B,115B,124C,137C,197C 'compon':32B 'context':200C 'copi':33B,181C 'craft':57B 'cve':11A,14A,108B 'cvss':68B 'data':37B,178C 'denial':79B 'disclos':92B 'execut':85B,125C,135C,196C 'exist':154C 'exploit':100B,114B,148C 'fix':90B 'flaw':153C 'heap':4A,40B,119C,186C 'heap-bas':118C,185C 'host':26B 'instal':140C 'issu':163C 'kb':74B 'known':97B 'lack':167C 'lan':18B 'length':45B,173C 'let':6A 'leverag':192C 'link':105B 'linux':19B 'maco':20B 'mdns':2A,21B,31B,58B,117C,159C 'network':7A,52B,131C 'network-adjac':130C 'nomachin':1A,22B,28B,65B,116C,142C 'nomachine':17A 'overflow':5A,122C 'packet':59B 'pars':157C 'parser':3A 'possibl':78B 'potenti':83B 'prior':179C 'proper':169C 'public':103B 'readm':111B 'record':36B,161C 'remot':123C 'repo':104B 'report':86B 'requir':146C 'resourc':35B,160C 'resource-record':34B 'result':164C 'run':9A,61B 'segment':53B 'self':25B 'self-host':24B 'send':55B 'server':30B 'servic':66B,81B,203C 'specif':152C 'suppli':177C 'unauthent':47B 'user':176C 'user-suppli':175C 'valid':170C 'vendor':73B 'vulner':126C,128C,150C,194C 'window':27B 'within':155C 'without':42B 'zdi':207C 'zdi-can':206C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92208","severity":null,"published_at":"2026-10-21T18:17:31+00:00","modified_at":"2026-10-23T12:18:18+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92208:519","url":null,"severity":null,"published_at":"2026-10-23T23:47:27+00:00","modified_at":"2026-10-23T23:47:27+00:00","first_seen_at":"2026-10-23T23:47:27+00:00","fetched_at":"2026-10-23T23:47:27+00:00","note":"ZDI-26-710 and NoMachine KB TR08X11934 give the fixed versions. The only affected version named is 9.8.2_1 (CPE), so the full range is unknown. Whether mDNS discovery must be enabled is not stated. The one 'PoC' repo is a README only. No X posts found."},{"source":"epss","external_id":"CVE-2026-92208","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92208","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":2163,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-710/","title":"ZDI-26-710 NoMachine mDNS Heap-based Buffer Overflow RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2164,"url":"https://kb.nomachine.com/TR08X11934","title":"NoMachine KB: crafted mDNS packet on LAN (CVE-2026-92208)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2165,"url":"https://exploit-intel.com/vuln/CVE-2026-92208","title":"Exploit-Intel: the only linked repo is a README, no exploit code","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}