NoMachine nxwebrunner heap overflow allows unauthenticated RCE
Original title: ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI rates CVE-2026-114549 at CVSS 9.8; the snippet names no versions and no confirmed attacks.
ZDI advisory ZDI-26-786 describes a heap-based buffer overflow in NoMachine's nxwebrunner. Remote attackers can execute arbitrary code on affected installations without authentication. ZDI assigned CVSS 9.8 and CVE-2026-114549. No patched release or exploitation status is given in the snippet.
Unconfirmed: No affected versions, fix, or exploitation status is stated.
- Advisory identifier is ZDI-26-786.
- The flaw is a heap-based buffer overflow.
- CVSS score assigned by ZDI is 9.8.
- Authentication is not required to exploit it.
Impact: unauthenticated remote arbitrary code execution
| Product | Affected |
|---|---|
| NoMachine nxwebrunner | — |
- CVEs
- CVE-2026-114549
- Vendors
- NoMachine
- Products
- nxwebrunner
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114549 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.