NVIDIA Project G-Assist (Windows display driver, R580/R570): A permissions flaw in the G-Assist component that ships

CVSS 7.8CVE-2025-23347NVIDIA / GPU stackcurated

Impact

A permissions flaw in the G-Assist component that ships inside the Windows display driver hands a low-privileged local account elevated code execution on the host. NVIDIA lists the full set of consequences: code execution, privilege escalation, data tampering, information disclosure and denial of service. This one matters beyond desktops because the affected branches cover Tesla-branded datacenter cards on Windows as well as GeForce, RTX, Quadro and NVS - so it is a driver-level escalation, not a consumer-app problem.

Who can reach it

A local, low-privileged account on a Windows host running an affected R580 or R570 display driver branch. No user interaction, no network access, and no need to touch the GPU directly - the vulnerable component is reachable from an ordinary user session.

What to do

Move Windows display drivers to 581.42 or later on the R580 branch, or 573.76 or later on R570. Driver replacement on Windows takes the display stack down and requires a reboot to complete, so schedule it as a maintenance window rather than a live update.

References

https://github.com/NVIDIA/product-security/tree/main/2025/5703 https://nvd.nist.gov/vuln/detail/CVE-2025-23347

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.