This flaw is caused by an incorrect permission assignment on a named pipe used by the NoMachine Device Service. The weakness lies in a CWE‑732 flaw that allows an attacker with local low‑privileged code execution to elevate to SYSTEM context and run arbitrary code. The vulnerability is limited to local systems and requires the attacker to first gain some executable foothold.

NoMachine installations are affected; the CNA data does not specify affected versions or build numbers so all current NoMachine products are potentially vulnerable.

The CVSS score of 7.8 marks it as high severity, and the EPSS score is not available. It is not listed in CISA’s KEV catalogue. The attack vector is local and leverages the faulty permissions on the named pipe; an attacker must already have the ability to run low‑privileged code on the host, after which they can manipulate the pipe to elevate to SYSTEM and execute arbitrary code.