CVE-2019-5701

7.8HIGH

Key Information:

Vendor
Nvidia
Status
Nvidia Geforce Experience
Vendor
CVE Published:
9 November 2019

Summary

NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access can load the Intel graphics driver DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service, information disclosure, or escalation of privileges through code execution.

Affected Version(s)

NVIDIA GeForce Experience before 3.20.0.118

References

https://nvidia.custhelp.com/app/answers/detail/a_id/4860
x_refsource_CONFIRM
https://github.com/active-labs/Advisories/blob/master/201...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.