NoMachine nxwebrunner heap buffer overflow allows remote code execution

Remote desktop program NoMachine lets anyone break into your PC!

Summary

The NoMachine web service (nxwebrunner) does not check the length of user input, causing a heap-based buffer overflow. An unauthenticated remote attacker can execute code with the service account's privileges.

Affected when

Web service listening on TCP port 4443 by default is enabled

What to do

The CVE record lists 9.7.3 as an affected version. Check that your NoMachine runs a newer version, and read the vendor's advisory.

Products and platforms

Windows
macOS
Linux
NoMachine

CVE IDs

CVE-2026-114549 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 23:46 UTC

First seen 2026-11-09 15:20 UTC