The add‑on contains a Log Reader feature that processes speech log entries in an unsafe way. Maliciously crafted logs can embed Python expressions that are evaluated while the log is read. When a user opens such a file and triggers a log reading command, attacker‑controlled code runs with the privileges of the current Windows account, allowing disclosure of data, modification of files, or further compromise. The flaw stems from the use of an unsafe evaluation function, classified as CWE‑943.

The vulnerability affects versions 2.0 through 8.0 of the NVDA Dev & Test Toolbox add‑on, developed by CyrilleB79. Version 9.0 includes a patch that disables the unsafe evaluation path. Only installations of the add‑on that have not been updated to 9.0 are at risk.

The flaw has a CVSS score of 7.8, indicating a high severity, but the EPSS score is below 1 % and the issue does not appear in the KEV catalog, reflecting a low current exploitation probability. An attacker would need to entice a user to open a malicious log file and invoke a log reading command. The exploit does not require elevated privileges and is therefore easy to trigger through user interaction or social engineering. While the likelihood of widespread exploitation remains low, the potential impact is significant if the user is running the add‑on without the latest update.