NVIDIA Nsight Graphics (ngfx component, Windows): An ngfx component resolves a DLL from an untrusted search path, so

Impact

An ngfx component resolves a DLL from an untrusted search path, so an attacker who can drop a file in the right directory gets their code loaded the next time a developer launches Nsight Graphics. The consequence is code execution and privilege escalation on the machine of someone who profiles GPU workloads - exactly the account that tends to hold source access, signing material and cluster credentials. Low fleet-wide reach, high value per host.

Who can reach it

A local, low-privileged account that can write into a directory in the loader's search path, plus a real user actually starting Nsight Graphics. NVIDIA rates the complexity high, so this is targeted rather than opportunistic - but the required write is often available on shared dev boxes with a loose system PATH.

What to do

Upgrade Nsight Graphics to 2025.3 or later. Independently, sweep the system PATH on developer machines for entries that non-admin users can write to and remove them - that removes this whole class of hijack, not just this instance.

References