CVE-2024-0121: NVIDIA GPU Display Driver RCE Vulnerability

CVE-2024-0121 Overview

CVE-2024-0121 is an out-of-bounds read vulnerability [CWE-125] in the NVIDIA GPU Display Driver for Windows. The flaw resides in the user mode layer of the driver. An unprivileged local user can trigger the condition to read memory outside the intended buffer boundaries. Successful exploitation may lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability requires local access and user interaction to exploit. NVIDIA acknowledged the issue and published a fix through its customer support advisory.

Critical Impact
Local unprivileged users can trigger an out-of-bounds read in the NVIDIA Windows display driver, potentially leading to code execution, privilege escalation, and information disclosure on affected workstations.

Affected Products

NVIDIA GPU Display Driver for Windows
Windows workstations and endpoints running vulnerable NVIDIA driver versions
Systems relying on the NVIDIA user mode driver components

Discovery Timeline

2024-10-26 - CVE-2024-0121 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0121

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition [CWE-125] in the user mode layer of the NVIDIA GPU Display Driver for Windows. When the driver processes crafted input, it reads memory past the allocated bounds of a buffer. This read primitive can be leveraged to leak process memory, destabilize the driver, or, when combined with additional flaws, contribute to code execution and privilege escalation. Because the affected component runs in the user mode driver layer, exploitation does not require prior privileges. However, the attacker must convince a user to execute a triggering workload or application. The impact spans confidentiality, integrity, and availability of the affected host.

Root Cause

The root cause is missing or insufficient bounds validation during buffer access in the NVIDIA user mode driver. When the driver processes attacker-influenced data structures, it references indices or pointers that fall outside the allocated region. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1955 for the underlying technical analysis.

Attack Vector

Exploitation requires local access to the target system and user interaction. An attacker delivers a crafted application, shader, or workload that the vulnerable driver processes. Once loaded, the malformed input triggers the out-of-bounds read within the user mode driver components. The attacker can then chain the primitive with other flaws to escalate impact. No verified proof-of-concept code is publicly listed for this issue at the time of writing. See the NVIDIA Customer Support Article for vendor guidance.

Detection Methods for CVE-2024-0121

Indicators of Compromise

Unexpected crashes or bug checks involving NVIDIA user mode driver modules such as nvwgf2umx.dll or related components
Anomalous processes loading NVIDIA driver DLLs from non-standard paths or via unusual parent processes
Windows Error Reporting entries citing access violations in NVIDIA graphics driver modules

Detection Strategies

Monitor endpoint telemetry for repeated NVIDIA driver faults tied to a specific user process, which may indicate exploitation attempts
Correlate GPU-related crash events with subsequent privilege changes, token manipulation, or suspicious child process creation
Track installation and execution of unsigned or newly introduced applications that invoke GPU workloads on sensitive endpoints

Monitoring Recommendations

Enable Windows crash and reliability telemetry forwarding to centralized logging for GPU driver fault analysis
Baseline NVIDIA driver versions across the fleet and alert on hosts running versions predating the vendor fix
Watch for post-exploitation behavior such as credential access, LSASS interaction, or lateral movement following NVIDIA driver crashes

How to Mitigate CVE-2024-0121

Immediate Actions Required

Identify all Windows endpoints and workstations running the NVIDIA GPU Display Driver and inventory installed driver versions
Apply the driver updates listed in the NVIDIA Customer Support Article as soon as validation permits
Restrict execution of untrusted applications and GPU workloads on high-value hosts until patching is complete

Patch Information

NVIDIA has published fixed driver versions through its security bulletin. Consult the NVIDIA Customer Support Article to identify the fixed driver branch that corresponds to your GPU family and Windows platform. Deploy the update using your standard driver management tooling and reboot to complete installation.

Workarounds

Limit local user privileges and enforce application allow-listing to reduce the likelihood of a malicious workload reaching the driver
Disable or remove NVIDIA driver features not required by business workflows where feasible until patching completes
Isolate systems that cannot receive the driver update from untrusted networks and user-supplied content