NoMachine Web Service Heap Overflow Enables Unauthenticated RCE; Patch to 10.1.7

A heap-based buffer overflow in the NoMachine web service exposes users to remote code execution without any authentication, according to the Zero Day Initiative. The advisory, identified as ZDI-26-786, highlights that attackers can exploit this flaw to run arbitrary code in the context of the service account. This exposure stems from improper validation of data length before copying it into a heap buffer, creating a direct path for unauthorized system access.

The risk

The vulnerability resides within the NoMachine web service, which typically listens on TCP port 4443. Because authentication is not required to exploit the flaw, any remote actor with network access to the service can trigger the buffer overflow. The Zero Day Initiative rates the vulnerability at 9.8 on the Common Vulnerability Scoring System, indicating a critical level of risk for exposed systems. Successful exploitation grants attackers code execution privileges aligned with the service account’s permissions.

Who is exposed

Organizations running unpatched versions of NoMachine are directly exposed to this threat. The Zero Day Initiative confirms that the vendor has released fixes for specific releases, including version 10.1.7, version 9.9.6, and version 8.27.1. Users operating on earlier builds remain vulnerable until they apply the corresponding updates. The coordinated public release of this advisory occurred on October 22, 2026, following the initial report to the vendor on July 24, 2026.

Cost and compliance

The Zero Day Initiative advisory does not provide specific financial impact data or regulatory compliance implications for this vulnerability. The source material focuses exclusively on the technical details of the heap-based buffer overflow and the availability of patches. No mention is made of data breaches, ransomware demands, or specific legal requirements triggered by this exposure. Security teams must assess their own internal compliance frameworks regarding unpatched critical vulnerabilities.

What to watch

Managers should prioritize verifying the current version of NoMachine installed across their infrastructure. Given the lack of authentication required for exploitation, immediate patching of the web service is essential to prevent unauthorized remote code execution. Organizations should also monitor network traffic on TCP port 4443 for unusual patterns that might indicate exploitation attempts before patches are fully deployed.

Signals worth monitoring

Teams usually detect this activity by reviewing web service logs for malformed requests or unexpected data lengths targeting TCP port 4443. Check whether the service account exhibits unusual process creation or outbound connections that deviate from normal behavior. Monitor for sudden spikes in CPU or memory usage on the host, which often accompany buffer overflow exploitation. First containment moves typically involve isolating the affected system from the network to prevent lateral movement while investigators assess the scope of the compromise.

What to do and how to stay safe: NoMachine

• Verify the installed version of NoMachine against the patched releases listed in the vendor advisory.
• Restrict network access to TCP port 4443 to trusted sources only until patches are applied.
• Monitor system logs for anomalous process executions originating from the NoMachine service account.
• Review firewall rules to ensure the web service is not exposed to untrusted networks.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What CVSS score did the Zero Day Initiative assign to this NoMachine vulnerability?

The Zero Day Initiative assigned a CVSS rating of 9.8 to this vulnerability.

Which NoMachine versions include the fix for the heap-based buffer overflow?

The vendor fixed the issue in versions 10.1.7, 9.9.6, and 8.27.1.

Is authentication required to exploit this NoMachine web service flaw?

No, the advisory states that authentication is not required to exploit this vulnerability.