CVE-2019-5701: nvidia geforce_experience Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-5701 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in nvidia geforce_experience. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities.

Timeline

1. 09-11-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access can load the Intel graphics driver DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service, information disclosure, or escalation of privileges through code execution.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.