Vulnerability in Microsoft Windows
CVE-2019-5695
NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in which an attacker with local system and privileged access can incorrectly load Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Microsoft Windows
- NVIDIA Geforce Experience
- NVIDIA GPU Driver
- NVIDIA Geforce Experience — versions prior to 3.20.1
- NVIDIA Windows GPU Display Driver — versions all versions
Weakness classification (CWE)
References
- nvidia.custhelp.com/app/answers/detail/a_id/4907 (Patch, Vendor Advisory)
- nvidia.custhelp.com/app/answers/detail/a_id/4860 (Patch, Vendor Advisory)
- safebreach.com/Post/NVIDIA-GPU-Display-Drivers-for-Windows-and-GFE-Software-DLL… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-5695?
- CVE-2019-5695 is a medium-severity vulnerability in Microsoft Windows, classified under Uncontrolled Search Path Element. CVSS score: 6.5/10. Published 2019-11-12.
- How severe is CVE-2019-5695?
- Medium severity. CVSS v3 base score is 6.5 out of 10.