Local Privilege Escalation in NoMachine for Windows by NoMachine

CVE-2021-33436

What is CVE-2021-33436?

The NoMachine for Windows application prior to specified versions is susceptible to local privilege escalation due to unsafe DLL loading practices. This flaw permits local non-privileged users to exploit any writable directory within the system path to perform DLL Hijacking. As a consequence, an attacker can execute arbitrary code with elevated privileges, running it as NT AUTHORITY\SYSTEM, which poses a significant risk to the integrity and security of the system.

References