CVE-2019-5694: nvidia nvidia gpu display driver Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-5694 is a medium (CVSS 6.5) Uncontrolled Search Path Element vulnerability in nvidia nvidia gpu display driver. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-11-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution. The attacker requires local system access.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.