Vulnerability Spotlight: Remote code execution bugs in NVIDIA D3D10 driver
Summary: Cisco Talos discovered multiple remote code execution vulnerabilities in the NVIDIA D3D10 driver, version 442.50 - 26.21.14.4250, tracked as TALOS-2020-1035 through TALOS-2020-1039 and CVE-2020-5981. A specially crafted shader can trigger code execution and allow a guest-to-host escape through Hyper-V RemoteFX on Windows machines, and Talos worked with NVIDIA to resolve the issues and release an update.
Bottom line: A malformed shader is enough to move an attacker from a guest VM to the host through Hyper-V RemoteFX, so any environment running this driver version in a virtualized setup has a path out of the sandbox until the NVIDIA update is applied.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-5981
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026