CVE-2026-107820

Name of the Vulnerable Software and Affected Versions x64dbg-MCP Server versions prior to 1.2

Description The software exposes debugger functionality over HTTP and listens on 0.0.0.0 by default. In the src/core/mcp server.zig file, the parseContentLength() function parses an unbounded Content-Length value, which is subsequently used in an unchecked usize addition within the wsRecv() function before token authentication occurs. An unauthenticated network client can provide a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds. This results in a denial of service by terminating the x64dbg process and its active debugging session. Integer overflow is a condition where an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of digits.

Recommendations Update to version 1.2.