NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime): A crafted shader overruns a shader-local
Impact
A crafted shader overruns a shader-local temporary array, giving code execution in the graphics driver. Same delivery surface as the texture-array bug: wherever attacker-authored shaders reach your GPUs, this is remote code execution against the host driver.
Who can reach it
Anyone able to submit shaders - remote/VDI session users, tenant VMs, or local processes.
What to do
Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.
References
Related entries
- NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime): A crafted shader reads out of bounds on anCVE-2019-5684 · NVIDIA Windows GPU Display Driver, DirectX driver (shader compiler/runtime)Critical
- RISC-V ISA (MTVEC register) as used in NVIDIA GPU microcontrollers: A documented ambiguity in the RISC-V specificationCVE-2021-1104 · RISC-V ISA (MTVEC register) as used in NVIDIA GPU microcontrollersCritical
- DGX A100 BMC: unauthenticated stack overflow in the host KVM daemon leads to RCECVE-2023-31024 · DGX A100 BMCCritical
- Base Command Manager (CMDaemon): Unauthenticated RCE on the cluster managerCVE-2024-0138 · Base Command Manager (CMDaemon)Critical
- NVIDIA Isaac Launchable: Hard-coded credentials in Isaac Launchable give an unauthenticated network attacker codeCVE-2025-33222 · NVIDIA Isaac LaunchableCritical
- NVIDIA Isaac Launchable: Execution with unnecessary privileges lets an unauthenticated network attacker reach codeCVE-2025-33223 · NVIDIA Isaac LaunchableCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.