NVIDIA Slurm allows a user to modify the supplemental group list during an sbcast file transfer, enabling the creation of files in locations that the user normally cannot access. This vulnerability permits arbitrary file writes, which can be used to overwrite or add critical system files, potentially leading to malicious code execution or persistence on the system. The weakness arises from a lack of proper authorization checks on group membership during file transmission, classified as CWE-862.

The affected product is NVIDIA Slurm. No specific version information is provided, so all deployed instances of Slurm managed by NVIDIA are potentially vulnerable. Administrators should verify the installed Slurm version and consult NVIDIA documentation for updates.

The score of 6.3 indicates a moderate to high risk; the EPSS score is not available, and this issue is not listed in the CISA KEV catalog. The likely attack vector is local: a credentialed or unprivileged user who can initiate sbcast transfers can manipulate group membership to gain write access to protected paths. The lack of broader availability or remote exploitation pathways reduces the immediate threat surface but does not mitigate the potential consequences of an attacker using this path to compromise the system.