NoMachine CVE-2026-111184

Exploitation requires that NoMachine be installed with its Device Service running (the default service component on affected Windows installations) AND that the attacker already holds the ability to run low-privileged code on the same host. The concrete flaw is an overly-permissive access-control list on a named pipe owned by the Device Service, allowing an unprivileged local process to interact with the privileged pipe endpoint. Limiting factors: this is strictly local (AV:L) - there is no remote or network-triggerable path - and it presupposes an existing foothold (PR:L), so it cannot be used for initial access and offers no value against a host where the attacker has no prior code execution. No user interaction is required (UI:N).

This is a credible, actionable local privilege escalation that should be prioritized where NoMachine is deployed on multi-user or endpoint systems, though it is not an internet-facing emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) is internally consistent with the description: exploitation requires local access and existing low-privileged code execution (PR:L), has low attack complexity (AC:L), needs no user interaction, and yields full SYSTEM-level confidentiality, integrity, and availability impact. The signals do not conflict - attack vector and description agree that this is local-only. The limiting factor is the AV:L/PR:L precondition: an attacker must already have a foothold on the host, so this is a second-stage escalation primitive rather than an initial-access flaw. EPSS score is not provided in the input, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The low-complexity named-pipe permission weakness (CWE-732) is the kind of flaw that is reliable and weaponizable once details are public, so treat ZDI advisory publication as a trigger to patch promptly on affected Windows endpoints.

An attacker who already has unprivileged code execution on a Windows host running NoMachine (e.g., via a phishing payload or a compromised standard user account) connects to the improperly-secured named pipe exposed by the NoMachine Device Service. By impersonating or injecting into the privileged pipe endpoint, the attacker coerces the service into executing attacker-controlled code as SYSTEM, achieving full host compromise. No public exploit code is referenced in the input, so this reflects the attack path described by ZDI rather than an observed in-the-wild exploit.