CVE-2026-114549Critical· 9.8▾ Hadal0dayNoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit …
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 0.1 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
Last analysed / modified upstream
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.
NoMachine 9.7.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92208High· 8.8NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2026-111184High· 7.8NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
CVE-2026-92209High· 7.8NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
CVE-2026-92210High· 7.2NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
CVE-2025-15059High· 7.8GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2023-3428Medium· 6.2Imagemagick: heap-buffer-overflow in coders/tiff.c