CVE-2024-0118: NVIDIA GPU Display Driver RCE Vulnerability

CVE-2024-0118 Overview

CVE-2024-0118 affects the NVIDIA GPU Display Driver for Windows. The flaw resides in the user mode layer of the driver, where an unprivileged local user can trigger an out-of-bounds read [CWE-125]. Successful exploitation can lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

The vulnerability requires local access and user interaction, but no prior privileges. Attackers can leverage the flaw to breach the boundary between user-mode applications and privileged driver components on affected Windows systems.

Critical Impact
An unprivileged local user can trigger an out-of-bounds read in the NVIDIA display driver, potentially leading to code execution, privilege escalation, information disclosure, and data tampering.

Affected Products

NVIDIA GPU Display Driver for Windows
User mode driver layer components
Refer to the NVIDIA Support Answer for the specific affected driver branches and versions

Discovery Timeline

2024-10-26 - CVE-2024-0118 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0118

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the user mode layer of the NVIDIA GPU Display Driver for Windows. Out-of-bounds reads occur when a program reads memory outside the intended buffer boundary. In driver code paths that process user-supplied input, the condition allows attackers to observe adjacent memory contents or corrupt program state.

Because the flaw resides in the user mode layer, exploitation does not begin with kernel-level access. However, the driver interfaces with privileged GPU components, and consequences extend beyond simple memory disclosure. NVIDIA notes that successful exploitation can result in code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Attack complexity is low, and no privileges are required to initiate the exploit. User interaction, such as running a crafted application or opening malicious content that invokes the driver, is required to trigger the vulnerable code path.

Root Cause

The root cause is missing or insufficient bounds validation when the user-mode driver component processes attacker-controlled input. When a request or data structure specifies an offset or length outside the allocated buffer, the driver reads memory beyond the intended range instead of rejecting the request.

Attack Vector

The attack vector is local. An attacker with the ability to execute code on the target Windows system as an unprivileged user can craft input that reaches the vulnerable driver interface. The condition requires user interaction, consistent with scenarios where a victim runs an attacker-supplied application or graphical workload that exercises the driver.

Refer to the Talos Intelligence Vulnerability Report for additional technical details on the affected code path.

Detection Methods for CVE-2024-0118

Indicators of Compromise

Unexpected crashes or bug checks referencing NVIDIA display driver modules in Windows Event Logs or Windows Error Reporting artifacts
Untrusted or unsigned processes issuing repeated calls to NVIDIA user-mode driver interfaces
Anomalous child processes spawned from graphics-related applications following driver interaction

Detection Strategies

Inventory installed NVIDIA display driver versions across the Windows fleet and compare against fixed versions listed in the NVIDIA advisory
Correlate application crash telemetry with driver module names to identify potential exploitation attempts against the user-mode layer
Monitor for exploitation patterns that combine information disclosure primitives with subsequent privilege escalation activity

Monitoring Recommendations

Enable Windows Error Reporting collection and forward driver-related crash dumps to a centralized location for review
Alert on new or unsigned binaries that load NVIDIA user-mode DLLs shortly before crash or privilege-change events
Track outbound network activity from processes that interact with the GPU driver to detect post-exploitation staging

How to Mitigate CVE-2024-0118

Immediate Actions Required

Apply the updated NVIDIA GPU Display Driver for Windows as specified in the NVIDIA Support Answer
Identify all Windows endpoints and workstations running NVIDIA GPU drivers and prioritize systems used by high-value or administrative users
Restrict the ability of unprivileged users to execute untrusted applications that could invoke the vulnerable driver interfaces

Patch Information

NVIDIA has published a security bulletin with fixed driver versions. Administrators should consult the NVIDIA Support Answer to identify the correct patched driver branch for each installed GPU and deploy the update through standard software management workflows.

Workarounds

No official workaround replaces installing the fixed driver; treat the patch as the authoritative remediation
Where immediate patching is not possible, limit local user execution privileges and enforce application allow-listing to reduce the pool of code that can reach the driver
Segment high-risk workstations from sensitive resources until updated drivers are deployed

bash

# Query installed NVIDIA display driver version on Windows via PowerShell
Get-CimInstance Win32_VideoController |
  Where-Object { $_.Name -match 'NVIDIA' } |
  Select-Object Name, DriverVersion, DriverDate