A critical code execution vulnerability in the NVDA Dev & Test Toolbox add-on (versions 2.0 to 8.0) allows attackers to execute arbitrary code with user privileges via malicious log files.

The Log Reader component improperly handles log entries, leading to the evaluation of embedded Python expressions. This vulnerability is triggered when a user opens a specially crafted log file and utilizes log reading commands, requiring no elevated privileges but necessitating user interaction.

Successful exploitation allows an attacker to execute arbitrary code within the context of the user running the NVDA application. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, or the deployment of further malicious payloads on the affected workstation.

Immediate Action: Update the NVDA-Dev-Test-Toolbox to version 9.0 or later immediately to incorporate the necessary security fixes.

Proactive Monitoring: Monitor user environments for the use of legacy add-on versions and audit file access patterns if suspicious log files are observed.

Compensating Controls: If an immediate update is not feasible, disable log reading gestures within the input gesture dialog or refrain from using log reading commands entirely to prevent the execution of malicious Python expressions.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability, combined with the ease of exploitation through social engineering, necessitates immediate attention. Organizations utilizing the NVDA Dev & Test Toolbox should prioritize upgrading to version 9.0 across all installations to eliminate the risk of arbitrary code execution.