CVE-2022-34669: nvidia cloud_gaming External Control of File Name or Path
Vulnerability summary
CVE-2022-34669 is a high (CVSS 8.8) External Control of File Name or Path vulnerability in nvidia cloud_gaming. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.6% of scored vulnerabilities.
Timeline
- 30-12-2022PublishedVulnerability first disclosed.
- 10-04-2025Last modifiedVulnerability information updated.
Description
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Nvidia3 products
- cloud_gaming< 527.27
- vgpu software (guest driver) - windows, nvidia cloud gaming (guest driver)All versions prior to and including 14.2, 13.4, and 11.9, and all versions prior to the November 2022 release
- virtual_gpu< 11.11 | ≥ 13.0, < 13.6 | ≥ 14.0, < 14.4
1 vendor · 3 products
References
1 links- nvidia.custhelp.com/app/answers/detail/a_id/5415Vendor Advisory