x64dbg-MCP Server CVE-2026-107824

Requires a running x64dbg instance with the x64dbg-MCP Server plugin (prior to v1.1) that is network-reachable on its default port - 9094 for x64 or 9095 for x32 - because the server binds 0.0.0.0 by default and, before the fix, Bearer token authentication was optional and disabled by default. No credentials, user interaction, or special configuration are needed beyond the default deployment; the only practical limits are that the x64dbg GUI debugger must be actively running and the listening port must not be blocked by a host or network firewall. Because this is a reverse-engineering tool rather than always-on infrastructure, realistic exposure depends on whether an operator left an instance bound to a routable interface.

All available signals align toward high real-world risk for exposed instances. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), scoring 9.3 - and the description corroborates this: the server binds 0.0.0.0 by default with no authentication, so any client reaching the port gets full debugger control, memory read/write, and arbitrary file write. The key tempering signal is EXPOSURE rather than any CVSS weakness: the tool is a developer/reverse-engineering plugin, so the attack surface depends entirely on whether a running x64dbg+MCP instance is reachable from an untrusted network. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of active or at-scale exploitation; the public fix commit documents the vulnerable behavior but is a patch, not an exploit. Net: a genuine critical-severity issue where real-world risk is gated primarily by low deployment footprint and network reachability, not by any mitigating factor in the vulnerability itself.

An attacker able to reach the host on TCP 9094 (x64) or 9095 (x32) - the default 0.0.0.0 binding - sends unauthenticated MCP/HTTP requests and invokes debugger tools to attach to a process by PID, read and write its memory, run arbitrary x64dbg commands, and write files to arbitrary paths, resulting in full host compromise. Exploitation is trivial given AV:N/AC:L/PR:N/UI:N, requiring only network access to a running instance. No public exploit is identified at time of analysis, though the patch commit publicly reveals the missing-auth behavior.