Attacking the Windows NVIDIA Driver
Summary: Project Zero's Oliver Chang found 16 vulnerabilities in NVIDIA's Windows kernel-mode graphics drivers during a 20% project, 13 of them in the DxgkDdiEscape interface, which NVIDIA exposes with roughly 400 escape codes callable directly from user mode. The bugs were basic mistakes - blind writes to user pointers, leaking uninitialised kernel memory, and missing bounds checks - and one in NvStreamKms.sys, a driver installed by default with GeForce Experience and compiled without stack cookies, allowed local privilege escalation via a UNC path that overflows a stack buffer.
Why it matters: The vulnerable interfaces were reachable from the sandboxed Chrome GPU process, so a browser renderer compromise could chain into kernel-level code execution - and NVIDIA fixed 6 of the bugs silently in the 372.90 release with no bulletin, leaving attackers a window to reverse the patch before defenders knew what to look for.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026