Out-of-bounds read vulnerability in NVIDIA driver; Open-source flashcard software contains multiple security issues
Summary: Cisco Talos disclosed and patched six new vulnerabilities over three weeks, including an out-of-bounds read in a compiler driver for certain NVIDIA graphics cards (TALOS-2024-1956, CVE-2024-0107) that researchers triggered from a Hyper-V guest via RemoteFX to execute code on the Hyper-V host. Most of the disclosures affect Ankitects Anki flashcard software, where a malicious shared flashcard can exploit flaws including script injection (TALOS-2024-1993, CVE-2024-26020) rated 9.6 out of 10 for arbitrary code execution.
Key Takeaway: A 9.6-rated flaw reachable by opening a shared flashcard turns a study tool into a code-execution path, and the NVIDIA driver bug was demonstrated as a guest-to-host escape on Hyper-V, a feature Microsoft has deprecated but that may remain on older Windows systems.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-0107CVE-2024-26020CVE-2024-29073CVE-2024-32152CVE-2024-32484
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026