Vulnerability Spotlight: Denial-of-service vulnerability in NVIDIA driver
Summary: Cisco Talos discovered a denial-of-service vulnerability in NVIDIA's NVWGF2UMX_CFG.DLL driver (versions 26.21.14.4128 and 26.21.14.4166, and 441.28 and 441.66 on NVIDIA Quadro K620) that a specially crafted pixel shader can trigger. Talos confirmed the bug, tracked as TALOS-2019-0971/CVE-2020-5965, can be triggered from a VMware guest and crashes the vmware-vmx.exe process on the host, tested against VMware Workstation 15 (15.5.1 build-15018445) with Windows 10 x64 as guest.
Bottom line: A shader file passed from a guest VM is enough to crash the host process, so a workload running inside a virtual machine can take down the machine it sits on. Talos worked with NVIDIA and VMware on an update, and Snort rules 52495 and 52496 are listed to detect exploitation attempts.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2020-5965
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026