X64Dbg Mcp Server
Monthly
Unauthenticated remote access to x64dbg-MCP Server prior to version 1.1 lets any network client that can reach the plugin's HTTP/SSE listener execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. The listener binds to 0.0.0.0 by default and, before the fix, Bearer token authentication was optional and disabled by default, so a default installation with a running x64dbg GUI is fully controllable without credentials (CWE-306), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied, so exploitation likelihood rests on exposure of ports 9094 (x64) or 9095 (x32).
A remote denial-of-service condition in x64dbg-MCP Server before version 1.2 lets an unauthenticated network client crash the debugger and destroy any active debugging session by sending a crafted HTTP request with a near-maximum Content-Length value. The unbounded value is parsed and then used in an unchecked integer addition inside wsRecv() before the token check runs, so no credentials are required, and pre-1.2 builds bind the listener to 0.0.0.0 by default, making the endpoint broadly reachable. The resulting integer-overflow panic only terminates the process in Debug and ReleaseSafe builds (a ReleaseFast build would not panic), so the impact is limited to loss of availability rather than memory corruption or code execution; there is no confirmed active exploitation and no public exploit code identified at time of analysis.
Unauthenticated remote access to x64dbg-MCP Server prior to version 1.1 lets any network client that can reach the plugin's HTTP/SSE listener execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. The listener binds to 0.0.0.0 by default and, before the fix, Bearer token authentication was optional and disabled by default, so a default installation with a running x64dbg GUI is fully controllable without credentials (CWE-306), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied, so exploitation likelihood rests on exposure of ports 9094 (x64) or 9095 (x32).
A remote denial-of-service condition in x64dbg-MCP Server before version 1.2 lets an unauthenticated network client crash the debugger and destroy any active debugging session by sending a crafted HTTP request with a near-maximum Content-Length value. The unbounded value is parsed and then used in an unchecked integer addition inside wsRecv() before the token check runs, so no credentials are required, and pre-1.2 builds bind the listener to 0.0.0.0 by default, making the endpoint broadly reachable. The resulting integer-overflow panic only terminates the process in Debug and ReleaseSafe builds (a ReleaseFast build would not panic), so the impact is limited to loss of availability rather than memory corruption or code execution; there is no confirmed active exploitation and no public exploit code identified at time of analysis.