A heap-based buffer overflow vulnerability exists in the NoMachine nxwebrunner web service, which listens on TCP port 4443 by default. This flaw allows remote attackers to execute arbitrary code without authentication by exploiting improper validation of user-supplied data length before copying it to a heap buffer. The vulnerability has a critical severity with a CVSS score of 9.8.