CVE-2026-24191: NVIDIA Display Driver DoS Vulnerability

CVE-2026-24191 Overview

CVE-2026-24191 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the NVIDIA Display Driver for Windows. A local attacker with low privileges can exploit the timing window between resource validation and resource use to manipulate state expected by the driver. Successful exploitation can lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution. The flaw is tracked under CWE-367 and was published to the National Vulnerability Database on May 26, 2026. NVIDIA has issued guidance through its NVIDIA Support Article.

Critical Impact

Local attackers can escalate privileges and execute arbitrary code on Windows systems running affected NVIDIA Display Driver versions.

Affected Products

• NVIDIA Display Driver for Windows (versions specified in the NVIDIA Support Article)
• Windows systems with vulnerable NVIDIA GPU driver installations
• Workstations and endpoints with NVIDIA graphics hardware

Discovery Timeline

• 2026-05-26 - CVE-2026-24191 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24191

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) flaw in the NVIDIA Display Driver for Windows. The driver validates a resource or condition at one point, then uses that resource later without re-validating. An attacker who can run code on the system can change the resource state between these two operations.

This race condition affects kernel-mode driver components, where successful exploitation grants attackers access to privileged operations. The CVSS Scope flag indicates the impact crosses security boundaries, allowing user-mode attackers to influence kernel-mode behavior. Outcomes include denial of service, privilege escalation, information disclosure, data tampering, and arbitrary code execution.

Root Cause

The root cause is non-atomic handling of shared state in the driver. The driver checks a property such as a handle, pointer, or permission attribute, then operates on that property without holding a lock or re-validating the data. An attacker with local access manipulates the resource during this gap, bypassing the security check.

Attack Vector

The attack requires local access and low privileges. The attack complexity is rated high because the attacker must win a narrow timing race. No user interaction is required. The vulnerability mechanism centers on concurrent threads or processes modifying a shared object while the driver processes a request. Refer to the NVD CVE-2026-24191 entry for the full technical record.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose because no validated exploitation samples have been released.

Detection Methods for CVE-2026-24191

Indicators of Compromise

• Unexpected NVIDIA driver crashes or nvlddmkm.sys bug checks in Windows event logs
• Anomalous handle duplication or symbolic link manipulation activity from non-privileged processes
• New kernel-mode threads or modules loaded immediately after a low-privileged process interacts with NVIDIA driver IOCTLs

Detection Strategies

• Monitor DeviceIoControl calls targeting NVIDIA driver device objects from unexpected user-mode processes
• Track parent-child process relationships where standard user processes spawn privileged children following driver interaction
• Audit driver version inventory across endpoints to identify systems running unpatched NVIDIA Display Driver releases

Monitoring Recommendations

• Enable Windows kernel auditing for driver load events and unusual IOCTL patterns
• Correlate endpoint telemetry to detect rapid repeated calls to NVIDIA driver interfaces, a hallmark of race condition exploitation
• Centralize driver crash dumps and bug check telemetry for retrospective analysis

How to Mitigate CVE-2026-24191

Immediate Actions Required

• Apply the patched NVIDIA Display Driver version referenced in the NVIDIA Support Article
• Inventory all Windows endpoints and workstations running NVIDIA GPU drivers and prioritize patching
• Restrict local logon rights on systems running the vulnerable driver until updates are deployed

Patch Information

NVIDIA has released updated Windows display driver packages addressing CVE-2026-24191. Administrators should consult the NVIDIA Support Article for the specific fixed versions and download links. Driver updates can be deployed via NVIDIA's installer, enterprise software distribution tools, or Windows Update where applicable.

Workarounds

• Limit local user accounts and remove unnecessary interactive logon privileges on affected systems
• Apply application control policies to block untrusted binaries from executing on systems with vulnerable drivers
• Where feasible, isolate high-value workstations until patches are deployed

# Verify NVIDIA driver version on Windows endpoints
wmic path win32_VideoController get name,driverversion

# PowerShell alternative for fleet inventory
Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*NVIDIA*" } | Select-Object DeviceName, DriverVersion, DriverDate