CVE-2025-8614: NoMachine Privilege Escalation Vulnerability

CVE-2025-8614 is a privilege escalation vulnerability in NoMachine that exploits an uncontrolled search path in OpenSSL configuration. Attackers with low-level access can execute code as a service account. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2025-8614 Overview

CVE-2025-8614 is a local privilege escalation vulnerability in NoMachine remote desktop software. The flaw stems from an uncontrolled search path element [CWE-427] in the product's OpenSSL configuration handling. NoMachine loads an OpenSSL configuration file from an unsecured location, allowing a low-privileged local user to introduce a malicious configuration and execute arbitrary code in the context of the service account.

Zero Day Initiative tracked this issue as ZDI-CAN-26766 and published advisory ZDI-25-835. Successful exploitation grants attackers full control over the affected host through the elevated service context.

Critical Impact
A local attacker with limited privileges can escalate to the NoMachine service account and execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

NoMachine (Windows installations) prior to the vendor's fixed release
Deployments referenced in vendor advisory TR04W11314
Installations relying on the default OpenSSL configuration search path

Discovery Timeline

2025-09-02 - CVE-2025-8614 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8614

Vulnerability Analysis

The vulnerability resides in how NoMachine locates and loads its OpenSSL configuration file. During service startup or subsequent cryptographic operations, the product searches directories that are writable by unprivileged users. An attacker who can execute low-privileged code on the host can plant a crafted openssl.cnf in one of these locations.

OpenSSL configuration files support directives that load engines and providers from arbitrary shared libraries. When the NoMachine service consumes the attacker-controlled configuration, it loads the referenced module and executes code in the service account context. This transforms a standard user session into full service-level compromise.

Exploitation requires local code execution but no user interaction. Because NoMachine typically runs with elevated privileges to broker remote sessions, the attacker gains a highly privileged foothold suitable for persistence, credential theft, and lateral movement.

Root Cause

The root cause is an insecure OpenSSL configuration search path [CWE-427]. NoMachine does not restrict the lookup to a trusted, ACL-protected directory. Any path that permits write access to standard users can supply the configuration consumed by the elevated process.

Attack Vector

The attack vector is local. An attacker with an interactive session or code execution as a low-privileged user places a malicious OpenSSL configuration file, and optionally a companion shared library, in the unsecured search location. The next time the NoMachine service loads OpenSSL, the crafted directives execute attacker code as the service account. Refer to the Zero Day Initiative Advisory ZDI-25-835 for additional technical context.

Detection Methods for CVE-2025-8614

Indicators of Compromise

Unexpected openssl.cnf or .cnf files created in directories writable by non-administrative users on hosts running NoMachine
New or modified shared libraries referenced by OpenSSL engine or provider directives in non-standard locations
NoMachine service processes spawning unusual child processes such as command interpreters or scripting engines

Detection Strategies

Monitor file creation events in unsecured directories that fall within OpenSSL's configuration search path on Windows hosts
Alert on module loads by NoMachine service processes that originate from user-writable paths
Correlate low-privileged process activity with subsequent high-privilege actions performed under the NoMachine service account

Monitoring Recommendations

Enable process creation and image load auditing on all endpoints where NoMachine is installed
Track integrity of NoMachine installation directories and OpenSSL configuration paths using file integrity monitoring
Review authentication and session logs for anomalous privilege transitions tied to the NoMachine service

How to Mitigate CVE-2025-8614

Immediate Actions Required

Apply the vendor-supplied update referenced in NoMachine Knowledge Base Article TR04W11314 as soon as possible
Inventory all systems running NoMachine and prioritize multi-user or shared workstations for patching
Restrict local logon rights on hosts running NoMachine to reduce the pool of users capable of exploiting the flaw

Patch Information

NoMachine has published guidance in knowledge base article TR04W11314 that addresses the uncontrolled search path condition. Administrators should upgrade to the fixed release identified in the advisory and verify that OpenSSL configuration loading is constrained to protected directories after installation.

Workarounds

Remove write permissions from any directories in the OpenSSL configuration search path that are accessible to standard users
Set the OPENSSL_CONF environment variable for the NoMachine service to an ACL-protected path controlled only by administrators
Where patching is delayed, limit NoMachine deployment to single-user hosts until the update is applied