TI-2023-14754 Aliases CVE-2023-31017 GHSA-73mh-5vh2-9fc3

NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be…

LOW 35CWE-552Published 2023-11-02 · Updated 2024-09-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse points. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00205 10th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NVIDIA	NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver	All versions prior to and including 13.8, 15.3, 16.1 and all versions prior to and including September 2023 release	—	No fix listed	CNA

NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver VendorNVIDIA Affected All versions prior to and including 13.8, 15.3, 16.1 and all versions prior to and including September 2023 release Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nvidia:virtual_gpu::::::::	before 13.9; 14.0 to before 15.4; 16.0 to before 16.2	Vulnerable	NVIDIA
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:* Versions before 13.9; 14.0 to before 15.4; 16.0 to before 16.2 Vulnerable ·NVIDIA
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-31017
2026-10-03 Alias added: GHSA-73mh-5vh2-9fc3

References

Advisory 1

https://nvidia.custhelp.com/app/answers/detail/a_id/5491

TI-2022-10972 Out-of-bounds write in NVIDIA GPU Display Driver CVSS 3.1CRITICAL 9.9
TI-2023-00183 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer… CVSS 3.1HIGH 8.8
TI-2022-15487 NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer… CVSS 3.1HIGH 8.8
TI-2022-10973 Out-of-bounds write in NVIDIA GPU Display Driver CVSS 3.1HIGH 8.5
TI-2023-14764 Uncontrolled search path in NVIDIA GPU Display driver, vGPU driver, and Cloud gaming… CVSS 3.1HIGH 8.2
TI-2024-00080 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can… CVSS 3.1HIGH 7.8

See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences