An attacker can trigger a heap-based buffer overflow in the slurmstepd process of NVIDIA Slurm. The flaw is exposed while slurmstepd runs with root privileges, allowing the attacker to inject malicious data into the buffer and potentially execute arbitrary code with elevated system authority. Such an injection may lead to full system compromise or modification of critical configurations, directly affecting confidentiality, integrity, and availability.

The vulnerable component is NVIDIA Slurm, specifically the slurmstepd service. No specific version information is provided, so any release that includes the affected slurmstepd routine could be at risk until a corrective update is applied.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is unavailable, so it is unclear how frequently this vulnerability is being exploited, and the flaw is not listed in CISA KEV. The likely attack vector is exploitation of slurmstepd while it is running as root, which might be possible locally or remotely if the process accepts external input. Successful exploitation would give attackers full root-level control over the host, making this a critical issue for any environment running Slurm.