NoMachine CVE-2026-92208

The attacker must be network-adjacent (AV:A) - i.e. on the same local link / multicast broadcast domain as the target - because the flaw is in NoMachine's parsing of mDNS (link-local multicast) resource records; it is not exploitable across routed/internet boundaries without an mDNS relay. NoMachine must have its mDNS service discovery active and listening (default behavior for host discovery). No authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are required against a reachable instance. The primary limiting factor is the adjacency requirement: hosts on isolated or segmented networks, or with mDNS disabled/filtered at the switch, are not reachable by this attack.

Signals are moderately consistent and point to a genuine but condition-gated priority. The CVSS 3.0 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8 High) establishes unauthenticated code execution with full CIA impact, but the ADJACENT attack vector (AV:A) - not Network - is the decisive risk-limiter: the attacker must sit on the same logical link/broadcast domain as the target, since mDNS is a link-local multicast protocol. This is NOT internet-wide remotely exploitable. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public weaponization; this is a ZDI-coordinated disclosure (ZDI-CAN-30982 / ZDI-26-710), which typically means a patch-coordinated advisory rather than in-the-wild abuse. The combination of low attack complexity, no authentication, no user interaction, and heap-overflow-to-RCE in a service-account context makes this attractive for lateral movement on shared LANs (offices, coworking spaces, conference/hotel/guest networks), but the adjacency requirement keeps it below the tier of a wormable internet-facing flaw. Net: treat as a high-priority patch for endpoints on untrusted or shared L2 networks, lower priority for isolated/segmented hosts. No conflicting signals, but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input.

An attacker on the same local network segment as a NoMachine host (e.g. a shared office LAN, public Wi-Fi, or guest VLAN) broadcasts a crafted mDNS resource record containing an oversized length field. NoMachine's mDNS parser copies the user-supplied data into an undersized heap buffer without bounds validation, corrupting heap memory and allowing arbitrary code execution in the context of the service account. No authentication or user interaction is required; no public exploit was identified at time of analysis.