Loading story…
NVIDIA released security updates for multiple high-severity flaws in its GPU Display Driver for Windows and Linux, as well as in NVIDIA vGPU and Cloud Gaming software. The vulnerabilities include CVE-2024-0126, an improper input validation issue rated CVSS 8.2 that could let a local authenticated attacker escalate privileges and execute code, along with CVE-2024-0117 through CVE-2024-0121, which affect Windows user-mode components and can lead to out-of-bounds reads, information disclosure, denial of service, and in some cases further compromise with user interaction.
NVIDIA also patched virtualization-related flaws including CVE-2024-0127 and CVE-2024-0128, which affect supported hypervisors and Azure Stack HCI deployments and could enable improper resource access, data tampering, denial of service, privilege escalation, or code execution. Updated fixed versions were issued across major driver branches including R565, R550, and R535, with corresponding updates for GeForce, RTX, Quadro, NVS, Tesla, vGPU, and Cloud Gaming products, and defenders were urged to upgrade affected systems promptly.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
NVIDIA updated the security bulletin after its initial release, as reflected in the revision history. The edit was recorded separately from the original publication.
NVIDIA issued a security bulletin covering multiple high-severity vulnerabilities in GPU Display Driver software for Windows and Linux and in NVIDIA vGPU software. The bulletin documented issues including CVE-2024-0117 through CVE-2024-0121, CVE-2024-0126, CVE-2024-0127, and CVE-2024-0128, and provided updated driver and vGPU releases to remediate them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NVIDIA released fixes for several high-severity vulnerabilities across its Windows and Linux display drivers, installers, and virtual GPU stack that could let attackers escalate privileges, corrupt memory, crash systems, or access sensitive data. The disclosed issues include `CVE-2025-23277`, an out-of-bounds kernel memory access flaw in NVIDIA Display Drivers for Windows and Linux; `CVE-2025-23281`, a Windows driver use-after-free tied to concurrent memory handling; `CVE-2025-23276`, a Windows installer access-control weakness that can yield administrator-level code execution during installation or update; and `CVE-2025-23279`, a TOCTOU race condition in the Linux and Solaris `.run` installer that can allow arbitrary code execution as root.
Jun 29, 2026
NVIDIA has disclosed a high-severity vulnerability in its Display Driver, identified as CVE-2025-23309, which involves an uncontrolled DLL loading path. This flaw could allow attackers to cause arbitrary denial of service, escalate privileges, execute code, or tamper with data on affected systems. The vulnerability is not remotely exploitable, indicating that an attacker would require local access to exploit the issue. According to the official CVE entry, the vulnerability was published on October 10, 2025, and is being tracked by NVIDIA’s Product Security Incident Response Team (PSIRT). While the specific affected product versions are not listed in the CVE feed, the issue is confirmed to impact NVIDIA Display Driver software. In parallel, security reports highlight that NVIDIA has released patches addressing multiple high-severity vulnerabilities in its GPU drivers, some of which risk remote code execution (RCE) and privilege escalation. These patches are part of NVIDIA’s ongoing efforts to mitigate risks associated with their graphics drivers, which are widely used in both consumer and enterprise environments. The vulnerabilities addressed in the latest update could potentially be leveraged by attackers to gain unauthorized access or control over systems running vulnerable driver versions. Organizations using NVIDIA GPU drivers are strongly advised to review the latest security advisories and apply the recommended patches to reduce exposure. The disclosure underscores the importance of maintaining up-to-date drivers, as vulnerabilities in such low-level system components can have significant security implications. Security teams should also monitor for any signs of exploitation attempts targeting these flaws, especially in environments where local access by untrusted users is possible. The high CVSS score of 8.2 for CVE-2025-23309 reflects the potential impact of successful exploitation. NVIDIA’s prompt response and patch release demonstrate the company’s commitment to addressing security issues in its products. Enterprises should ensure that their asset inventories accurately reflect the presence of NVIDIA drivers and prioritize patching accordingly. The incident also highlights the broader trend of attackers targeting device drivers as a means to bypass operating system security controls. Given the critical role of GPU drivers in system performance and security, timely remediation is essential to prevent potential compromise. Security advisories from both NVIDIA and independent security researchers provide detailed guidance on mitigation steps. Regular vulnerability management processes should incorporate driver updates as a key component of endpoint security. Finally, organizations should consider implementing additional controls, such as application whitelisting and user privilege restrictions, to further reduce the risk of exploitation.
Jun 29, 2026
NVIDIA issued security updates for multiple products across its AI and enterprise software stack, fixing vulnerabilities that could allow **remote code execution**, denial of service, privilege escalation, data tampering, and information disclosure. The most severe issue disclosed in its broader March advisories was `CVE-2025-33244` in **NVIDIA Apex**, a widely used PyTorch extension for mixed-precision and distributed training. High-severity flaws were also addressed in **Triton Inference Server**, **Megatron LM**, **NeMo Framework**, and **Model Optimizer**, with NVIDIA warning that exploitation could disrupt AI workloads, expose sensitive training data, or enable unauthorized access. Medium-severity issues were additionally listed in **VIRTIO-Net**, **SNAP4**, and **B300 MCU**. NVIDIA later released urgent fixes for **TensorRT-LLM** and **Isaac Launchable**, including TensorRT-LLM deserialization flaws in MPI server and RPC testing components that could lead to RCE, data manipulation, information disclosure, or service outages. It also patched a Linux issue in Isaac Launchable involving sensitive information sent in clear text, creating risks of privilege escalation and system disruption. NVIDIA advised customers to upgrade **TensorRT-LLM** to `1.2.1` or later, and said organizations running multi-GPU deployments should use: ```bash trtllm-llmapi-launch ``` to reduce network exposure. The company has also begun publishing PSIRT bulletins on GitHub in Markdown and CSAF formats to support automated vulnerability management and faster remediation.
Jun 29, 2026