NoMachine web player heap overflow lets unauthenticated attackers run code (CVE-2026-114549)
NoMachine (nxwebrunner / Web Player)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Zero Day Initiative and NoMachine disclosed CVE-2026-114549, a pre-authentication heap buffer overflow in NoMachine's nxwebrunner web service (default TCP 4443). Unauthenticated remote attackers can execute code as the service account (CVSS 3.0 9.8). NoMachine's trouble report says the bug is fixed in 10.1.7, 9.9.6 and 8.27.1 (solved versions published Oct 27 2026); the CVE record was published around Nov 3–4 2026. Affected lines include 8.27 before 8.27.1, 9.9 before 9.9.6 and 10.1 before 10.1.7. Upgrade immediately; until then restrict or disable access to the web player port. No public exploit or CISA KEV listing was reported at publication.
Why this severity: CVSS 9.8 unauthenticated RCE on the web service (TCP 4443); no known exploitation at CVE publication
- Started
- Oct 27, 2026
Affected
- NoMachine 8.27 before 8.27.1
- NoMachine 9.9 before 9.9.6
- NoMachine 10.1 before 10.1.7
Fixed in
- 8.27.1
- 9.9.6
- 10.1.7
Timeline2
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
