NoMachine NXWebRunner Vulnerability Allows Critical Remote Code Execution
A critical heap-based buffer overflow in NoMachine's NXWebRunner component, rated CVSS 9.8, allows unauthenticated remote attackers to execute arbitrary code.
Zero Day Initiative (ZDI) has disclosed a critical heap-based buffer overflow vulnerability in NoMachine's nxwebrunner component, identified as ZDI-26-786 and assigned CVE-2026-114549. This flaw, rated critical with a CVSS score of 9.8, poses a significant risk as it allows unauthenticated remote attackers to execute arbitrary code on vulnerable systems.
The vulnerability resides within the web service, which by default listens on TCP port 4443. The root cause is the lack of proper validation for the length of user-supplied data before it is copied into a heap-based buffer. This oversight enables an attacker to overwrite memory, leading to the execution of malicious code within the context of the service account running the web service.
Exploitation of this vulnerability does not require any form of authentication, making it particularly dangerous. Attackers can remotely trigger this buffer overflow by sending specially crafted data to the vulnerable web service. Successful exploitation could grant attackers full control over the affected NoMachine server, allowing them to install programs, view, change, or delete data, and create new accounts with administrative privileges.
NoMachine has addressed this critical vulnerability in several of its product versions. Patches are available for versions 10.1.7, 9.9.6, and 8.27.1. Users are strongly advised to update their NoMachine installations to the latest available versions to mitigate the risk of exploitation. The company's knowledge base article TR07X11893 provides further details on the fix.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on July 24, 2026. Following coordinated efforts between ZDI and NoMachine, the advisory was publicly released on October 22, 2026, with an update to the advisory also occurring on the same day. This coordinated disclosure process aims to give users sufficient time to apply patches before the vulnerability becomes widely known and potentially exploited.
The vulnerability was discovered and reported by Sajeeb Lohani. The Zero Day Initiative, a PGP-owned vulnerability disclosure program, plays a crucial role in identifying and responsibly disclosing security flaws to vendors, thereby enhancing the security posture of software products worldwide.
This heap-based buffer overflow in NoMachine's web service is a serious concern for organizations utilizing the software for remote access and management. The ability for unauthenticated remote code execution means that any internet-facing or network-accessible NoMachine instance could be a target. Administrators should prioritize applying the available updates to protect their systems from potential compromise.