NVIDIA Windows GPU Display Driver, DirectX 11 user-mode driver (nvwgf2um.dll): Crafted shader triggers an out-of-bounds

Impact

Crafted shader triggers an out-of-bounds access in the DX11 user-mode driver, this time rated code-execution capable. Anywhere untrusted shaders reach the GPU - VDI, cloud gaming, remote rendering - treat it as RCE at the session's privilege level.

Who can reach it

Anyone who can submit shaders to the host, including from a guest VM or remote session.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References