NVIDIA OpenShell CVE-2026-65085

Exploitation requires a local account on a Linux host with NVIDIA OpenShell installed and the inference proxy actively running (AV:L, PR:L). The attacker does not require administrator or root privileges - a low-privilege OS account is sufficient. There is no user interaction requirement. The vulnerability is specific to the inference proxy subcomponent; if that proxy is not deployed or not running, the attack surface does not exist. Scope change (S:C) means a secondary component must be reachable from the proxy's output path. No network-based exploitation is possible given the local attack vector.

The CVSS 5.2 Medium rating is driven by AV:L (local access required), PR:L (low-privilege account sufficient), AC:L (low attack complexity), and S:C (scope change), with C:L and I:L reflecting limited but real confidentiality and integrity impact and no availability impact. The local vector meaningfully constrains exploitation to users who already have a foothold on the affected Linux host, which limits the attack surface compared to network-accessible flaws. However, the scope change is a meaningful signal: it indicates the inference proxy's improperly escaped output can affect a secondary component, potentially one with elevated privileges. No EPSS score was provided in source data; given no KEV listing and no known POC, opportunistic mass exploitation is unlikely. The realistic risk is an insider threat or post-compromise lateral movement scenario. The absence of a pinned affected version range in CPE data makes scoping difficult - defenders cannot easily determine which OpenShell builds are safe.

A local user with a standard Linux account on a host running NVIDIA OpenShell sends a crafted inference request to the proxy that causes it to emit improperly escaped output. Because the proxy's scope change (S:C) affects a downstream component, that component processes the malformed output in a way that leaks inference data from other users or tampers with the data pipeline between the proxy and the backend runtime.