The vulnerability is a heap‑based buffer overflow in NoMachine's handling of mDNS resource records. The flaw stems from missing length validation of data before copying it to a heap buffer, allowing an attacker to corrupt memory and execute arbitrary code in the service account context. This is a classic stack corruption scenario represented by CWE‑122.

The flaw affects installations of NoMachine, but the CA‑identified version range is not listed in the advisory. Therefore any deployment of NoMachine that has not applied the available patch is potentially vulnerable.

The advisory assigns a CVSS score of 8.8, indicating a high‑severity remote code execution risk. Authentication is not required and only requires a network‑adjacent attacker to send a specially crafted mDNS packet. Although EPSS data is missing, the lack of authentication and ability to run code as the service account suggest that an exploitation attempt would likely succeed under the right conditions. The vulnerability is not currently listed in CISA's KEV catalog.