Medium severity · published Oct 9, 2026
CVE-2026-107820
x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
X6
x64dbg-mcp-server · duty1g
< 1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107820
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107820
x_refsource_CONFIRM
https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-jgj3-97w2-9v9r
x_refsource_MISC
https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-4478-h5jv-647m
x_refsource_MISC
https://github.com/duty1g/x64dbg-mcp-server/commit/0dd4204d37c81d8b605133dc48c14886eeac1562
x_refsource_MISC
https://github.com/duty1g/x64dbg-mcp-server/releases/tag/v1.2
More from x64dbg-mcp-server
9.3
CVE-2026-107824
x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
