CVE-2024-7253 is a local privilege escalation flaw in NoMachine on Windows, scored 7.8 (High) in the record. A low-privileged user can get code running as SYSTEM through a library loaded from an unsecured location. NoMachine fixed it in version 8.12.13 for the 8.x line and 7.15.6 for the 7.x line.
What's affected
The record lists NoMachine as the affected product, with no version range in the CPE data. The vendor's own trouble report fills that gap. NoMachine's knowledge base entry TR07V11184 says both NoMachine v8 and v7 were affected on all Windows platforms, and that the product concerned is the NoMachine Server.
Fixed versions, per that same entry:
- NoMachine 8.x: fixed in 8.12.13
- NoMachine 7.x: fixed in 7.15.6
Anything older in either line should be treated as exposed. The weakness is classed as CWE-427, uncontrolled search path element. The record's CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means local access, low complexity, low privileges, no user interaction, and full impact on confidentiality, integrity and availability.
One point where the sources differ: the NVD style record scores this 7.8 High, while the NoMachine knowledge base labels the trouble report severity as Critical. Both are on record. For prioritization, remember that the attacker needs to run code on the machine first, which is why the network based scores you see for remote bugs do not apply here.
The two descriptions also name different parts of the product. The record, taken from the Zero Day Initiative advisory, says the flaw lives in nxnode.exe, which loads a library from an unsecured location. NoMachine says the permissions on the folder C:\ProgramData\NoMachine\nxserver were too wide, so unprivileged users could place a DLL that gets loaded when the nxserver service starts. These read as two views of one problem: a writable location that a privileged process trusts.
How to check if you're exposed
- Find every Windows host running NoMachine Server. Check installed programs or your endpoint inventory.
- Read the installed version in the NoMachine About dialog or from the Programs list. Compare it against 8.12.13 and 7.15.6.
- Inspect the folder permissions the vendor named. From an elevated prompt, run
icacls "C:\ProgramData\NoMachine\nxserver"and look for write or modify rights granted to broad groups such as Users or Everyone. - If you build images with NoMachine baked in, check the installer version in your build scripts, not only the running hosts.
An unpatched host with narrow permissions is still worth updating. A host with wide permissions on that folder should be treated as exposed until upgraded.
What to do now
- Upgrade NoMachine to 8.12.13 or later on the 8.x line, or 7.15.6 or later on the 7.x line. The vendor links its software update notes SU07V00257 and SU07V00258 for these builds.
- After upgrading, re-run the icacls check and confirm the nxserver folder is no longer writable by standard users.
- Review who has interactive or remote logon rights on hosts that run the server. The attack needs a foothold first, so reducing low-privilege accounts reduces the risk.
- Search file system or EDR telemetry for unexpected DLLs under the NoMachine data folder.
- Add NoMachine to your software inventory so the next advisory is easy to match to hosts.
Why it matters
Services that run as SYSTEM and load code from a folder that ordinary users can write to are a classic path to full control of a Windows machine. The service does exactly what it is designed to do. The failure is trust: it treats a directory as safe when anyone on the box can change what is inside it.
Remote desktop software is a natural place for this to matter. These hosts often accept many users, including contractors, and a local escalation on a shared server turns one weak account into administrator level access. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of review, and nothing fetched for this post says it is exploited in the wild.
Quick check
Do I need to be on the network to abuse this?
No, and that is the point. The attacker must already be able to run low-privileged code on the Windows host. The risk is escalation from a small foothold to SYSTEM.
Which NoMachine version should I install?
On the 8.x line, 8.12.13 or newer. On the 7.x line, 7.15.6 or newer. Confirm against NoMachine's knowledge base entry before rolling out.
Sources
Scan a manifest for affected packages with the free in-browser dependency scan at gold.safeguard.sh/scan, or browse the Gold directory for related entries.
Last reviewed: 19 October 2026.
