---
id: "CVE-2026-92208"
kind: "vulnerability"
aliases: ["CVE-2026-92208"]
title: "NoMachine: mDNS parser heap overflow lets network attackers run code"
severity: "high"
cvss: 8.8
epss: 0.00584
exploited: false
status: "open"
category: "other"
products: [{"name": "NoMachine", "fixed": ["10.1.7", "9.9.6", "8.27.1"], "affected": "9.8.2_1 confirmed; full range unknown, fixed branches listed", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["lan", "linux", "macos", "mdns", "nomachine", "other", "self-hosted", "windows"]
not_affected_if: ["patched-version", "unknown"]
published_at: "2026-10-21T18:17:31+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92208", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:47:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92208", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# NoMachine: mDNS parser heap overflow lets network attackers run code

NoMachine's server mDNS component copies resource-record data into a heap buffer without checking its length. An unauthenticated attacker on the same network segment can send a crafted mDNS packet and run code as the NoMachine service account (CVSS 8.8, AV:A). The vendor KB calls it a possible denial of service with potential code execution. Reported 2026-08-07, fixed and disclosed 2026-09-16. Not known to be exploited. The only public repo linked to the CVE is a README with no exploit code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NoMachine affected 9.8.2_1 confirmed; full range unknown, fixed branches listed fixed 10.1.7, 9.9.6, 8.27.1

## How to check

Check the installed NoMachine version in the NoMachine client or tray, under About, or in the server's installed package. Anything below 10.1.7 (10.x), 9.9.6 (9.x) or 8.27.1 (8.x) should be treated as exposed. Whether mDNS discovery must be enabled for the bug to be reachable is not stated in the sources.

## Fix

Update NoMachine to 10.1.7, 9.9.6 or 8.27.1, whichever matches your branch (https://kb.nomachine.com/software-updates). The vendor KB writes the 8.x fix as 8.27 and ZDI writes 8.27.1. Until you have patched, keep NoMachine hosts off shared or untrusted LAN segments.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92208
- 2026-10-23T23:47:27+00:00 analyst — ZDI-26-710 and NoMachine KB TR08X11934 give the fixed versions. The only affected version named is 9.8.2_1 (CPE), so the full range is unknown. Whether mDNS discovery must be enabled is not stated. The one 'PoC' repo is a README only. No X posts found.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92208

## Documents

- [advisory] ZDI-26-710 NoMachine mDNS Heap-based Buffer Overflow RCE https://www.zerodayinitiative.com/advisories/ZDI-26-710/
- [fix] NoMachine KB: crafted mDNS packet on LAN (CVE-2026-92208) https://kb.nomachine.com/TR08X11934
- [mentions] Exploit-Intel: the only linked repo is a README, no exploit code https://exploit-intel.com/vuln/CVE-2026-92208

## From the sources

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_