CVE-2021-42972

CVE-2021-42972 describes a buffer overflow vulnerability in the NoMachine Server, specifically affecting versions above 4.0.346 and below 7.7.4. A local attacker can exploit this flaw by sending specially crafted I/O Request Packets to IOCTL Handler 0x22001B, potentially leading to arbitrary code execution in kernel mode or a denial of service through memory corruption and OS crashes. Rated with a CVSS score of 8.8 (High), this vulnerability requires local access but has low attack complexity and no user interaction, with high impacts on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received some community discussion and media coverage.