One note before I start:
I talk about theoretical threats, not about actually existing and widespread pieces of malware.
As long as you operate an account without admin and sudo privilege and infect it by e.g. installing (manually or automatically behind your back, after clicking somewhere you shouldn't have clicked) a malware program to your home folder, this infection should stay limited to this account.
I say should, because:
an admin user could launch the infected file from his account as root and infect the machine this way.
the malware could infect portable devices (USB sticks etc.) mounted by the user, and then get spread on other machines or other user accounts on the same machine, when you mount it with another user later.
the malware could spread itself over the network, infect another machine in your LAN and then infect the admin account when it's logged on next time and connects to the other infected computer.
there are various known possibilities how an application could bypass the restrictions. This is called "privilege escalation", which means that the application runs with higher privileges than allowed/intended due to exploited software bugs, too permissive file system permissions, etc ...
As Ubuntu comes with a sudo timeout > 0s, you are not required to enter your sudo password multiple times within a short time period (by default 15 minutes, if I remember right?) to run several commands as root, but just get prompted once for the first one. If the malware now overwrote a file for which the infected user has write access (enters a command to run itself as root using sudo) and you later run the file without using sudo, but within the timeout, you don't even notice that there's something going on with elevated privileges.
You see, most chances for the malware to infect the whole machine require user interaction and/or depend on how strictly one keeps his accounts, computers and pluggable drives separated.
The bugs allowing privilege escalations are usually quickly fixed after the developers learn about them, but in the time between the discovery of a bug through malicious hackers and the release of a fix, new malware could bypass the user restrictions exploiting the bug.
Most malware is probably not capable of elevating its privileges and getting root access to infect your entire machine, unless you manually grant it by entering your sudo password in the wrong input box. That means behaving carefully and thinking about every command you run twice (especially if other users have write permissions on a file you want to execute) should protect you pretty well.
However, there's never 100% security, because malware developers are often one step ahead of the software programmers responsible for bug fixes and security patches.