Threat database

x64dbg-MCP Server versions prior to 1.1 expose the debugger's full functionality over HTTP without any authentication, allowing unauthenticated network clients to execute arbitrary debugger commands, attach to processes, and manipulate memory and files. This critical vulnerability is fixed in version 1.1.

CVE-2026-107820 is an integer overflow vulnerability in the duty1g x64dbg-MCP Server plugin prior to version 1.2. The vulnerability arises from parsing an unbounded Content-Length header and performing unchecked addition, which can cause a runtime integer-overflow panic. This leads to termination of the x64dbg process and its live debugging session, resulting in a denial of service. The server listens on all interfaces by default, allowing unauthenticated network clients to trigger this condition. The issue is fixed in version 1.2.