This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
ZDI-26-710: NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
About this summary. This is a short, independently written summary of an article first published by Zero Day Initiative. Cyber Security News did not report or verify the underlying story. Read the original: http://www.zerodayinitiative.com/advisories/ZDI-26-710/
Source attribution: headline and facts are from Zero Day Initiative (zerodayinitiative.com). Summary method: excerpt of the source description. See our source attribution policy and corrections policy.
Related coverage
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
OverviewOn September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco…
The skb that wasn't freed - the Fragnesia primitive via Open vSwitch
TLDR: Exploit. This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions…
Credentials Are Still the Shortest Path In
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel…
Simuler des services Active Directory légitimes sur un réseau interne : le cas de l’exploitation de GPO
La simulation de services Active Directory légitimes sur un réseau interne est une capacité puissante et polyvalente qui peut être exploitée dans le contexte de divers…
On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025
Lors du Pwn2Own Berlin 2025, nous avons exploité VMware Workstation en abusant d'un Heap-Overflow dans l'implémentation de son contrôleur PVSCSI. L'allocation vulnérable…
1Password's AI patching benchmark is misleading
1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of…