This vulnerability stems from the NoMachine Device Server loading a shared library from an uncontrolled, unsecured location. When a local attacker successfully injects a malicious library, the application runs the library with elevated privileges, allowing the attacker to execute arbitrary code as the SYSTEM account. Consequently, an attacker can gain full control over the affected system, compromising confidentiality, integrity, and availability. The weakness is characterized by uncontrolled search path element access, corresponding to CWE‑427.

The affected product is NoMachine, specifically the Device Server component. No version information is provided in the advisory, so the scope includes all installations that rely on the Device Server's library loading behavior.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. Exploitation requires an attacker to have some level of code execution at a lower privilege first; from there the flaw permits escalation to SYSTEM. EPSS data is unavailable, so we cannot quantify the current risk of exploitation, but the lack of an official patch or workaround and the severity score suggest that administrators should treat it as a high risk. The vulnerability is not listed in CISA’s KEV catalog, but the potential for full system takeover makes it a priority target for mitigation.