CVE-2016-8812 Memory corruption in Quadro, NVS, and GeForce (all versions)
A stack buffer overflow in the NVIDIA kernel mode layer allows local attackers to cause denial of service or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8812?
CVE-2016-8812 is a high-severity memory corruption vulnerability in Quadro, NVS, and GeForce (all versions), published on 8 Nov 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before GFE 3.1.0.52 contains a vulnerability in the kernel mode layer (nvstreamkms.sys) allowing a user to cause a stack buffer overflow with specially crafted executable paths, leading to a denial of service or escalation of privileges.
Weakness: CWE-119
Which versions are affected by CVE-2016-8812?
It affects 1 product.
Products include Nvidia Geforce Experience.
How do I fix CVE-2016-8812?
No fix has been published for CVE-2016-8812 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-8812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-8812 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Quadro, NVS, and GeForce (all versions)
- CVE-2017-6250 Code injection in GeForce Experience
- CVE-2021-1073 Information disclosure in NVIDIA GeForce Experience Software
- CVE-2022-42291 Path traversal in GeForce Experience
- CVE-2021-23175 Missing authorization in NVIDIA GeForce Experience Software
- CVE-2020-5977 Path traversal in NVIDIA GeForce Experience Software
Sources
Also known as GHSA-2qfm-pppv-fqqv.