A code injection vulnerability in NVIDIA Apex, requiring local user privileges, could allow an attacker to achieve full system compromise, including privilege escalation and data tampering.

This vulnerability is a code injection flaw (CWE-94) within a Python component of the NVIDIA Apex software. An attacker with local, low-privileged access can provide a malicious file to the component, resulting in arbitrary code execution on the underlying host.

The potential for unauthorized code execution, privilege escalation, and data tampering poses a severe risk to organizational security. Given the CVSS score of 7.8, this vulnerability is classified as High severity, as it enables a local attacker to bypass security controls and gain significant control over the affected system. Successful exploitation could lead to full system compromise, loss of data integrity, and unauthorized access to sensitive information processed by the application.

Immediate Action: Update NVIDIA Apex to release 25.07 or later to resolve the underlying code injection flaw.

Proactive Monitoring: Review system logs for unauthorized file handling or execution patterns originating from the Python component within Apex.

Compensating Controls: Restrict local access to the system and ensure that only trusted users can interact with the affected Python components or upload files to the application environment.

Public Exploit Available: No — there is no confirmed public exploit available.

Organizations utilizing NVIDIA Apex must prioritize updating to version 25.07 immediately to eliminate the risk of code injection. Due to the high potential for privilege escalation and system-wide impact, failure to patch these instances leaves systems vulnerable to local attackers seeking to gain elevated control.