CVE-2024-0119: NVIDIA GPU Display Driver RCE Vulnerability

CVE-2024-0119 Overview

CVE-2024-0119 affects the NVIDIA GPU Display Driver for Windows. The vulnerability resides in the user mode layer, where an unprivileged local user can trigger an out-of-bounds read [CWE-125]. Successful exploitation may lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

The flaw requires local access and user interaction, but no prior privileges. NVIDIA published a security bulletin addressing this issue alongside related driver defects. See the NVIDIA Support Answer and the Talos Intelligence Vulnerability Report for vendor guidance and technical detail.

Critical Impact
A local unprivileged user can trigger an out-of-bounds read in the NVIDIA display driver, potentially resulting in code execution, privilege escalation, information disclosure, or system denial of service.

Affected Products

NVIDIA GPU Display Driver for Windows
Refer to the NVIDIA security bulletin for the full list of impacted branches and versions
Systems running vulnerable driver builds on Windows platforms

Discovery Timeline

2024-10-26 - CVE-2024-0119 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-0119

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the user mode layer of the NVIDIA GPU Display Driver for Windows. Out-of-bounds read defects occur when software reads memory outside the intended buffer boundaries. In graphics driver components, such reads can expose adjacent memory contents to unprivileged processes.

Because the flaw sits in the user mode layer of a widely deployed driver, any process able to interact with the driver interface can attempt to exercise the vulnerable code path. The advisory notes that consequences include code execution, denial of service, privilege escalation, information disclosure, and data tampering. This range of outcomes suggests the out-of-bounds read can influence subsequent operations beyond simple memory disclosure.

Root Cause

The root cause is missing or insufficient bounds checking on a buffer accessed by the user mode driver component. When a caller supplies crafted input, the driver reads past the end or before the beginning of the intended memory region. This condition is classified under [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires local access. An attacker must run code as a regular user on the target system and induce user interaction to trigger the vulnerable path. Typical local vectors include malicious applications, weaponized documents that invoke GPU features, or drive-by content processed by graphics-accelerated software. NVIDIA and Talos do not document public exploitation, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Technical details describing the affected code path are available in the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2024-0119

Indicators of Compromise

Unexpected crashes or bugcheck events in nvlddmkm.sys or user mode NVIDIA driver components
Anomalous access to NVIDIA driver device objects by non-graphics processes
Unsigned or newly deployed executables invoking GPU driver APIs shortly after landing on the host

Detection Strategies

Inventory endpoints running NVIDIA GPU Display Driver for Windows and compare installed versions against the fixed versions listed in the NVIDIA advisory
Alert on process crashes and Windows Error Reporting events that reference NVIDIA driver modules
Monitor for privilege escalation patterns where a low-privileged process is followed by SYSTEM-level child processes after driver interaction

Monitoring Recommendations

Collect Windows event logs, EDR telemetry, and crash dumps referencing NVIDIA driver modules into a central data lake for correlation
Track driver version drift across the fleet to identify hosts that fall behind on NVIDIA security updates
Correlate local privilege escalation alerts with recent execution of untrusted binaries that touch GPU driver interfaces

How to Mitigate CVE-2024-0119

Immediate Actions Required

Apply the NVIDIA GPU Display Driver update referenced in the NVIDIA Support Answer to all affected Windows systems
Prioritize patching on multi-user hosts, virtual desktop infrastructure, and workstations that run untrusted code
Restrict installation and execution rights so unprivileged users cannot run arbitrary local binaries

Patch Information

NVIDIA has released updated GPU Display Drivers for Windows that address CVE-2024-0119. Administrators should download the fixed driver branches directly from NVIDIA and validate deployment across all impacted GPU models. Refer to the vendor advisory for the specific fixed versions per driver branch.

Workarounds

No official workaround has been published by NVIDIA; patching is the supported remediation
Reduce exposure by limiting local logon rights and blocking execution of untrusted applications on GPU-equipped endpoints
Enforce application allowlisting to prevent unauthorized code from reaching the vulnerable driver interfaces

bash

# Verify installed NVIDIA driver version on Windows (PowerShell)
Get-CimInstance Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like '*NVIDIA*' } |
  Select-Object DeviceName, DriverVersion, DriverDate