CVE-2026-107824

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107824
Related
GHSA (2)
  • GHSA-4478-h5jv-647m
  • GHSA-jgj3-97w2-9v9r
Published
2026-10-09T17:45:17Z
Modified
2026-10-11T02:46:53Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
Details

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107824.json"
}
References

Affected packages

Git / github.com/duty1g/x64dbg-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/duty1g/x64dbg-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1aad0f88b9c27233d11dbccf08ca415eb5f49203
Fixed
e1daba0038959f88d25ff3376b2a7f922ffeb448
Fixed
71460745ae23b531e3602ee316849660310f85ce
Fixed
5b2995f7c7b604d3868b8daa4bbc283b94883729
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107824.json"