CVE-2024-0117: NVIDIA GPU Display Driver RCE Vulnerability

CVE-2024-0117 Overview

CVE-2024-0117 affects the NVIDIA GPU Display Driver for Windows. The vulnerability resides in the user mode layer and allows an unprivileged local user to trigger an out-of-bounds read [CWE-125]. Successful exploitation can lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw requires local access and user interaction to trigger. NVIDIA published a security advisory addressing this issue, and Cisco Talos documented the technical findings in its vulnerability report.

Critical Impact
A local attacker can leverage the out-of-bounds read to achieve code execution, escalate privileges, or disclose sensitive memory contents on affected Windows systems.

Affected Products

NVIDIA GPU Display Driver for Windows (user mode layer)
See the NVIDIA FAQ Article for the full list of affected branches and versions
See the Talos Intelligence Vulnerability Report for technical scope

Discovery Timeline

2024-10-26 - CVE-2024-0117 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0117

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the user mode component of the NVIDIA GPU Display Driver for Windows. The driver's user mode layer reads memory beyond the bounds of an allocated buffer when processing attacker-influenced input. Depending on the memory layout at exploitation time, the read can leak sensitive process memory, corrupt program state, or destabilize the driver process. NVIDIA rates the issue as impacting confidentiality, integrity, and availability. Because the driver runs with elevated trust when servicing graphics operations, downstream effects can include privilege escalation and arbitrary code execution.

Root Cause

The root cause is insufficient bounds validation when the user mode driver component parses or dereferences data supplied through its interface. A crafted input causes the driver to read past the end of a buffer, exposing adjacent memory to the caller or triggering undefined behavior.

Attack Vector

Exploitation requires local access with low privileges. An attacker executes code as an unprivileged user on the target Windows host and interacts with the NVIDIA driver interface using crafted input. User interaction is required. Remote exploitation over a network is not possible. Refer to the Talos Intelligence Vulnerability Report for a detailed description of the affected code path.

No public proof-of-concept exploit code has been released for CVE-2024-0117. Readers should consult the vendor and Talos advisories rather than synthetic examples.

Detection Methods for CVE-2024-0117

Indicators of Compromise

Unexpected crashes or exception events involving NVIDIA user mode driver DLLs on Windows endpoints
Non-graphics processes issuing repeated or malformed IOCTL calls to NVIDIA driver components
Unprivileged local processes spawning elevated child processes shortly after interacting with graphics driver interfaces

Detection Strategies

Inventory installed NVIDIA GPU Display Driver versions across the fleet and compare against the fixed versions listed in the NVIDIA FAQ Article
Alert on Windows Error Reporting (WER) events and crash dumps referencing NVIDIA user mode driver modules
Correlate local privilege escalation indicators with process activity that recently loaded NVIDIA driver components

Monitoring Recommendations

Monitor endpoint telemetry for anomalous access patterns to NVIDIA device objects from non-graphics workloads
Track driver version drift over time and flag hosts that fall behind the patched baseline
Retain process, module load, and crash telemetry for forensic review if exploitation is suspected

How to Mitigate CVE-2024-0117

Immediate Actions Required

Apply the NVIDIA GPU Display Driver update referenced in the NVIDIA FAQ Article to all affected Windows endpoints
Prioritize systems where untrusted users can execute code locally, such as shared workstations and virtual desktop infrastructure
Verify driver versions post-deployment to confirm the patch is active

Patch Information

NVIDIA published fixed driver versions in its security bulletin. Consult the NVIDIA FAQ Article for the exact patched versions across the affected driver branches, then deploy the update through standard enterprise patching workflows.

Workarounds

No official workaround replaces the patch; installing the fixed driver is the supported remediation
Restrict local logon rights and block execution of untrusted binaries on hosts running vulnerable driver versions until the update is applied
Where feasible, isolate high-value hosts with vulnerable drivers from general user workloads until patched

bash

# Verify installed NVIDIA display driver version on Windows via PowerShell
Get-CimInstance Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like '*NVIDIA*' } |
  Select-Object DeviceName, DriverVersion, DriverDate