CVE-2024-0071: NVIDIA GPU Display Driver RCE Vulnerability

CVE-2024-0071 Overview

CVE-2024-0071 is an out-of-bounds write vulnerability in the NVIDIA GPU Display Driver for Windows. The flaw resides in the user mode layer of the driver. An unprivileged local user can trigger a write outside the intended memory buffer boundary. Successful exploitation may lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The weakness is classified under CWE-125, and the vulnerability requires user interaction on the local system to trigger the vulnerable code path.

Critical Impact
A local, unprivileged user can achieve code execution and privilege escalation on affected Windows systems running vulnerable NVIDIA GPU display drivers.

Affected Products

NVIDIA GPU Display Driver for Windows (user mode layer)
Windows workstations and endpoints with vulnerable NVIDIA graphics drivers installed
See the NVIDIA Support Article for the complete list of affected driver branches and versions

Discovery Timeline

2024-03-27 - CVE-2024-0071 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0071

Vulnerability Analysis

The vulnerability is an out-of-bounds write in the user mode component of the NVIDIA GPU Display Driver for Windows. The driver fails to properly validate the size or index of data written to a memory buffer during processing of user-supplied input. When a local user submits crafted data to the driver interface, the write operation extends beyond the allocated buffer. This corrupts adjacent memory structures and can be leveraged to redirect execution flow. The vulnerability requires local access and user interaction, but does not require prior authentication or elevated privileges. Impact spans confidentiality, integrity, and availability. The EPSS score is 0.381% at the 31st percentile, indicating a relatively low probability of near-term public exploitation.

Root Cause

The root cause is insufficient bounds validation in the user mode layer of the display driver. The driver accepts input from user-mode processes and writes to internal buffers without verifying that the write offset or length remains within allocated memory. This aligns with CWE-125 (out-of-bounds read/write class weaknesses) and reflects a boundary check failure prior to the memory write.

Attack Vector

An attacker with local access to a Windows host runs an unprivileged process that opens a handle to the NVIDIA driver interface. The attacker sends crafted requests, such as I/O control calls or graphics API sequences, that reach the vulnerable user mode code path. User interaction is required, for example running a malicious application or opening crafted content that invokes the driver. Successful exploitation grants the attacker code execution in the driver context, enabling privilege escalation and system compromise. No verified public proof-of-concept code is available. Refer to the Talos Intelligence Vulnerability Report for technical details of the affected code path.

Detection Methods for CVE-2024-0071

Indicators of Compromise

Unexpected crashes or bug checks referencing NVIDIA driver modules such as nvlddmkm.sys companion user-mode components
Unprivileged processes opening handles to NVIDIA driver device objects and issuing unusual IOCTL sequences
New or unsigned child processes spawned in the context of graphics-related services shortly after driver interaction

Detection Strategies

Inventory endpoints for installed NVIDIA GPU Display Driver versions and compare against the fixed versions listed in the NVIDIA advisory
Monitor Windows Error Reporting and crash dumps for faulting modules associated with NVIDIA graphics drivers
Apply behavioral endpoint detection to flag privilege escalation attempts and anomalous process lineage originating from graphics-related processes

Monitoring Recommendations

Collect Sysmon Event ID 1 (process create) and Event ID 10 (process access) telemetry for graphics driver interactions
Alert on unprivileged processes accessing GPU driver device handles followed by token or integrity level changes
Correlate driver crash events with subsequent execution of unknown binaries on the same host

How to Mitigate CVE-2024-0071

Immediate Actions Required

Update the NVIDIA GPU Display Driver for Windows to a fixed version as specified in the NVIDIA Support Article
Prioritize patching workstations used by developers, engineers, and administrators, where GPU drivers are commonly installed
Restrict execution of untrusted applications on hosts that cannot be immediately patched

Patch Information

NVIDIA has released updated GPU Display Driver versions that correct the boundary validation logic in the user mode layer. Administrators should consult the vendor security bulletin at NVIDIA Support Article to identify the fixed driver branch and version applicable to their hardware. Deploy driver updates through standard software distribution tooling and verify installation with nvidia-smi or the NVIDIA Control Panel.

Workarounds

Limit local logon rights on affected hosts to reduce the population of users who can trigger the vulnerable code path
Enforce application allowlisting to block execution of untrusted binaries that could invoke the vulnerable driver interface
Where GPU acceleration is not required, disable or uninstall the NVIDIA display driver until patching is complete

bash

# Example: query installed NVIDIA driver version on Windows via PowerShell
Get-CimInstance -ClassName Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like "*NVIDIA*" } |
  Select-Object DeviceName, DriverVersion, DriverDate