Read the docs
TI-2026-70110 Aliases CVE-2026-107820

x64dbg-MCP Server pre-authentication DoS via Content-Length integer overflow

Priority LOW 30CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The duty1g x64dbg-mcp-server, an MCP plugin for x64dbg, is affected before 1.2. The parser in mcp_server.zig accepts an unbounded Content-Length value, and wsRecv() adds it to a usize without overflow checks before token authentication (CWE-190). An unauthenticated network client can send a near-maximum Content-Length to trigger an integer-overflow panic in Debug and ReleaseSafe builds, terminating the x64dbg process and its live debugging session. Affected versions listen on 0.0.0.0 by default.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed x64dbg-mcp-server (duty1g): 1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
duty1gx64dbg-mcp-serverbefore 1.21.2Patch availableCNA
  • x64dbg-mcp-server Vendorduty1g Affected before 1.2 Fixed in 1.2 Patch available CNA

Remediation

Upgrade x64dbg-mcp-server to version 1.2 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA x64dbg-mcp-server (duty1g) Fixed in 1.2

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107820
  2. 2026-10-13 CISA SSVC decision points changed

References

Other 4

  • TI-2026-70114 Missing authentication in x64dbg-MCP Server exposes debugger tools CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences