CVE-2024-0090

What it actually does

Out-of-bounds write in the NVIDIA GPU driver allows a local authenticated user to corrupt memory structures, enabling arbitrary code execution, privilege escalation, denial of service, information disclosure, or data tampering.

Why it matters to the business

Systems using affected NVIDIA drivers face elevated risk of full host compromise, service outages, and data loss; the vulnerability has been public for over two years with no known active exploitation campaigns yet downstream package dependencies increase exposure surface across developer ecosystems.

How an attack unfolds

An attacker with local low-privileged access supplies a crafted input that triggers the out-of-bounds write in the GPU driver, allowing them to overwrite adjacent memory and ultimately execute arbitrary code or escalate privileges.

How to fix it

Update NVIDIA GPU drivers to the latest vendor-supplied fixed release; for pinterest/querybook update to commit bc620dabaaf13ff1dcb30af0b46a490403fb9908; for electron-userland/electron-builder update to version 3f3419a483bcc43018ddb0c9fdeb38f6abdba84a.

How to confirm the fix worked

Verify driver version against vendor advisory after installation; confirm package manifests reference the listed fixed commits; re-run any local GPU stress or validation tests to ensure stability.

Typical attack path

1. Obtain local user access on a Windows or Linux host with vulnerable NVIDIA driver
2. Craft and submit malicious input to the driver interface
3. Trigger out-of-bounds write to corrupt memory
4. Achieve code execution, privilege escalation, or data tampering

How to detect it

Review system logs for unexpected GPU driver crashes or privilege changes around the time of suspected activity; inspect process creation events following GPU API calls; no specific threat actor artifacts are currently associated with this issue.

What your security team should do

• Prioritize driver updates on all systems with NVIDIA GPUs within the next 30 days given publication age
• Audit dependency trees for pinterest/querybook and electron-builder to ensure fixed commits are adopted
• Monitor for new EPSS increases or KEV addition and reassess patching urgency