early signals ZDI published

ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

// summary

A NoMachine nxwebrunner heap-based buffer overflow, CVE-2026-114549, enables unauthenticated remote code execution and is rated CVSS 9.8.

// from the source

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-114549.
Read at zerodayinitiative.com ↗ More from ZDI published

# more from ZDI published

  1. ZDI published

    ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability

    zerodayinitiative.com
  2. ZDI published

    ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability

    zerodayinitiative.com
  3. ZDI published infra

    ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

    zerodayinitiative.com
  4. ZDI published infra

    ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability

    zerodayinitiative.com