CVE-2026-114549

Summary

A heap-based buffer overflow in NoMachine's nxwebrunner web service (port 4443) allows unauthenticated remote attackers to execute arbitrary code by sending overly long input that overflows a heap buffer due to insufficient length validation.

Exploitability

Highly exploitable as no authentication is required and the flaw is a classic heap overflow without complexity barriers.

Blast radius

Successful exploitation grants full system compromise under the service account, enabling data theft, lateral movement, or ransomware deployment across the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to NoMachine version 6.13.90 or later, which contains the vendor's official fix for this vulnerability (ZDI-CAN-30685).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.