CVE-2019-5684
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution.
- CVSS 3.0
- 10.0 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 5.42% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- nvidia/gpu driver
- Source
- psirt@nvidia.com
References
- http://www.vmware.com/security/advisories/VMSA-2019-0012.htmlPatch, Third Party Advisory
- https://nvidia.custhelp.com/app/answers/detail/a_id/4841Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-28096Third Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0779Exploit, Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2019-0012.htmlPatch, Third Party Advisory
- https://nvidia.custhelp.com/app/answers/detail/a_id/4841Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-28096Third Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0779Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.